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(57)Abstract: 

PROBLEM TO BE SOLVED: To provide a means for 
identifying to which virtual private network(VPN) a 
received packet belongs to in an edge router which 
accommodates the same line, when plural VPNs are 
multiplexed to this line, 

SOLUTION: The VPN edge router is provided with a 
function for identifying the VPN, while using logical 
channel numbers multiplexed to the same line. Thus, the 
VPN can be identified by using the logical channel 
numbers multiplexed to a physical interface. Therefore, 
the number of VPN to be accommodated can be 
increased, without having to increase the number of 
physical lines. 
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* NOTICES * 

JPO and INPIT are not responsible for any 
damages caused by the use of this translation. 

1. This document has been translated by computer. So the translation may not reflect the original 
precisely. 

2. **** shows the word which can not be translated. 
3.1n the drawings, any words are not translated. 



CLAIMS 



[Claim(s)] 

[Claim 1] The physical interface which holds the receiving circuit to which it is router equipment 
which can hold two or more virtual private networks (henceforth "VPN"), and multiplex [ of two 
or more logical channels ] was carried out, The logical channel identifier currently assigned to 
each logic-channel of two or more above-mentioned logical channels, The memory holding the 
table showing correspondence relation with the VPN name currently assigned to two or more 
above-mentioned VPN, When the packet transmitted through one logical channel in two or more 
above-mentioned logical channels is received. Router equipment characterized by having the 
processing section with which search the above-mentioned table and the above-mentioned 
receive packet Judges it to be whether it belongs to which VPN among two or more above- 
mentioned VPN by using as a search key the logical channel identifier which the above- 
mentioned logical channel is assigned. 

[Claim 2] Two or more physical interfaces with which it is router equipment according to claim 1, 
and a transmitting circuit is held, respectively, The address information of the packet used for 
each VPN correspondence of two or more above-mentioned VPN by each VPN, It has the 
memory holding the routing table showing correspondence relation with the information which 
identifies two or more above-mentioned physical interfaces. The above-mentioned processing 
section Router equipment characterized by determining whether to transmit the above- 
mentioned receive packet from which physical interface among two or more above-mentioned 
physical interfaces by searching the above-mentioned routing table by using as a search key 
destination address information stored in the header unit of the above-mentioned packet 
[Claim 3] It is router equipment which it is router equipment according to claim 2, the above- 
mentioned routing table holds the relation between the address information of the packet used 
by each VPN, and the header information given in case a packet is outputted, and the above- 
mentioned processing section uses as a search key destination address information stored in the 
header unit of the above-mentioned packet, and is characterized by to determine the packet 
header information which searches the above-mentioned routing table and is given to the above- 
mentioned receive packet. 

[Claim 4] It is router equipment characterized by being router equipment given in any of claim 2 
or claim 3 they are, and holding physically the above-mentioned table and the above-mentioned 
routing table on the same memory. 

[Claim 5] It is router equipment which it is router equipment given in any of claim 1 thru/or claim 
4 they are, and the above-mentioned receiving circuit is an Asynchronous Transfer Mode (ATM) 
circuit, and is characterized by the above-mentioned logical channel identifiers being VPI and 
VCL 

[Claim 6] It is router equipment which it is router equipment given in any of claim 1 thru/or claim 
4 they are, and the above-mentioned receiving circuit is a Frame Relay circuit, and is 
characterized by the above-mentioned logical channel identifier being DLCI. 
[Claim 7] It is router equipment which the packet encapsulated by the L2TP header as which it 
is router equipment given in any of claim 1 thru/or claim 4 they are, and the above-mentioned 
receiving circuit is specified by L2TP (Layer2 Tunneling Protocol) is transmitted, and is 
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characterized by the above-mentioned logical channel identifier being the information in a L2TP 
capsule header. 

[Claim 8] It is VLAN as which it is router equipment given in any of claim 1 thru/or claim 4 they 
are, the above-mentioned receiving circuit is an Ethernet (trademark) circuit, and the above- 
mentioned logical channel identifier is specified by IEEE802.1Q. Router equipment characterized 
by being Tag. 

[Claim 9] It is router equipment given in any of claim 1 thru/or claim 4 they are, and the above- 
mentioned receiving circuit is PPP. Over It is router equipment which the packet encapsulated 
by Ethernet (trademark) is transmitted and is characterized by the above-mentioned logical 
channel identifier being the information in the capsule header. 

[Claim 1 0] It is router equipment which is router equipment given in any of claim 1 thru/or claim 
9 they are, and is characterized by the ability to set up the correspondence relation between the 
above-mentioned logical channel identifier which the above-mentioned router equipment can be 
connected with a control terminal, and is held in the above-mentioned table from the above- 
mentioned control terminal, and the above-mentioned VPN name. 

[Claim 11] It is router equipment. The 1st virtual private network (It is hereafter called "VPN".) 
The 1st local area network which belongs (it is called "LAN" below.) And the interface section 
which holds the circuit to which multiplex [ of the packet encapsulated with the same protocol ] 
is carried out. and it is transmitted from the 2nd LAN belonging to the 2nd VPN, Router 
equipment characterized by having a means to set up the identifier for identifying whether it 
belongs whether the packet which received from the 1st circuit of the above belongs to the 1st 
above VPN to the 2nd above VPN. 

[Claim 12] It is router equipment which it is router equipment according to claim 11, and the 
above-mentioned protocol is an Asynchronous Transfer Mode protocol, and is characterized by 
the above-mentioned identifiers being VPI and VCL 

[Claim 13] A virtual private network which is router equipment and is different, respectively (It is 
hereafter called "VPN".) Two or more local area networks which belong (it is called "LAN" 
below.) from — with the 1st interface section which holds the 1st circuit to which the packet 
encapsulated with the 1st protocol is transmitted The 2nd interface section which holds the 2nd 
circuit to which the packet encapsulated with the 2nd protocol from two or more LANs belonging 
to VPN which belongs to different VPN, respectively is transmitted, A means to set up the 1 st 
identifier for identifying whether the packet which received from the 1st circuit of the above 
belongs to which VPN, The 1st identifier of the above is router equipment which has a means to 
set up the 2nd identifier for identifying whether the packet which received from the 2nd circuit 
of the above belongs to which VPN, and is characterized by the 2nd identifiers of the above 
differing. 

[Claim 14] It is router equipment which it is router equipment according to claim 13, the 1st 
protocol of the above is an Asynchronous Transfer Mode protocol, the 1 st identifier of the above 
is VPI and VCI, and the 2nd protocol of the above is a Frame Relay, and is characterized by the 
2nd identifier of the above being DLCI. 

[Claim 1 5] It is router equipment. The 1 st virtual private network (It is hereafter called "VPN".) 
The 1 st local area network which belongs (it is called "LAN" below.) from — the packet 
encapsulated with the 1st protocol, and the packet encapsulated with the 1st protocol of the 
above from the 2nd LAN belonging to the 2nd VPN — ** — with the 1st interface section which 
holds the 1st circuit ******(ed) and transmitted The 2nd circuit to which the packet 
encapsulated with the 2nd protocol from the 3rd LAN belonging to the 3rd VPN is transmitted, 
The 2nd interface section which holds the 3rd circuit to which the packet encapsulated with the 
2nd protocol of the above from the 4th LAN belonging to the 4th VPN is transmitted, A means 
to set up the 1st identifier for identifying whether it belongs whether the packet which received 
from the 1st circuit of the above belongs to the 1st above VPN to the 2nd above VPN, The 1st 
identifier of the above is router equipment which has a means to set up the 2nd identifier for 
identifying whether it belongs whether the packet which received from the 2nd circuit of the 
above and the 3rd circuit of the above belongs to the 3rd above VPN to the 4th above VPN, and 
is characterized by the 2nd identifiers of the above differing. 
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[Claim 16] It is router equipment characterized by being a physical interface number being router 
equipment according to claim 15, the 1st protocol of the above being an Asynchronous Transfer 
Mode protocol, for the 1st identifier of the above being VPI and VCI, for the 2nd protocol of the 
above being PPP over SONET, and for the 2nd identifier of the above identifying the 3rd circuit 
of the above, and the 4th circuit of the above. 

[Claim 17] It is the packet transfer control approach in the router equipment which can hold two 
or more virtual private networks (henceforth "VPN"). The above-mentioned router equipment 
The logical channel identifier by which two or more logical channels hold the receiving circuit by 
which multiplex was carried out, and are assigned to each logic-channel of two or more above- 
mentioned logical channels. It has the table showing correspondence relation with the VPN name 
currently assigned to two or more above-mentioned VPN, The above-mentioned approach The 
packet transmitted through one logical channel in two or more above-mentioned logical channels 
is received. It is characterized by having the step which searches the above-mentioned table 
and judges whether the above-mentioned receive packet belongs to which VPN among two or 
more above-mentioned VPN by using as a search key the logical channel identifier which the 
above-mentioned logical channel is assigned. 

[Claim 18] It is the packet transfer control approach which it is the packet transfer control 
approach according to claim 17, and the above-mentioned receiving circuit is an Asynchronous 
Transfer Mode (ATM) circuit, and is characterized by the above-mentioned logical channel 
identifiers being VPI and VCI, 

[Claim 19] It is the setting approach of the VPN identification information in the router 
equipment which holds two or more local area networks (LAN) belonging to a virtual private 
network (henceforth "VPN") different, respectively. The above-mentioned router equipment 
receives the packet encapsulated with the 1st protocol from some LANs of two or more above- 
mentioned LANs, and the packet encapsulated with the 2nd protocol is received from other 
LANs of two or more above-mentioned LANs. Have memory and the packet which received the 
above-mentioned approach from LAN of a part of above sets the 1st identifier for identifying 
whether it belongs to which VPN as the above-mentioned memory. The 2nd identifier for 
identifying whether the packet which received from LAN besides the above belongs to which 
VPN is set as the above-mentioned memory, and it is characterized by the 2nd identifier of the 
above differing from the 1 st identifier of the above, 

[Claim 20] The setting approach of the VPN identification information characterized by having 
further the step which is the setting approach of VPN identification information according to 
claim 19, sets up the 1st table showing the correspondence relation between the 1st identifier of 
the above, and the VPN number currently assigned to VPN, and sets up the 2nd table showing 
the correspondence relation between the 2nd identifier of the above, and the VPN number 
currently assigned to VPN, 

[Claim 21] It is the setting approach of the VPN identification information which it is the setting 
approach of VPN identification information given in any of claim 19 or claim 20 they are, the 1st 
protocol of the above is an Asynchronous Transfer Mode protocol, the 1st identifier of the above 
is VPI and VCI, and the 2nd protocol of the above is a Frame Relay, and is characterized by the 
2nd identifier of the above being DLCI. 

[Claim 22] The packet transfer control approach characterized by to have the step which is the 
packet transfer control approach in the router equipment which holds two or more virtual private 
networks (henceforth "VPN"), receives the IP packet to which the capsule header by the 
protocol equivalent to a layer 2 was given, and determines whether the IP packet which carried 
out [ above-mentioned ] reception belongs to which VPN using the information in the above- 
mentioned capsule header. 

[Claim 23] Router equipment characterized by having a means to determine whether the IP 
packet which carried out [ above-mentioned ] reception belongs to which VPN using the 
information in the above-mentioned capsule header as the interface section which is router 
equipment which holds two or more virtual private networks (henceforth "VPN"), and receives 
the IP packet to which the capsule header by the protocol equivalent to a layer 2 was given. 
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DETAILED DESCRIPTION 



[Detailed Description of the Invention] 
[0001] 

[Field of the Invention] This invention relates to the router equipment which is applied to router 
equipment, its packet transfer control approach, and the routing information setting approach in 
router equipment, especially builds the virtual private network (VPN:Virtual Private Network) in 
the Internet, its transfer control approach, and its setting approach. 
[0002] 

[Description of the Prior Art] When two or more networks in a company which exist in a different 
area conventionally were connected by the network, the company was building the network (that 
is, security was secured) isolated from the external network by interconnecting the network in a 
company by the dedicated line. However, when the dedicated line was used, there was a problem 
that network cost will go up. For this reason, it is cheap and the demand to the technique of 
building the imagination dedicated line network (it being hereafter called VPN:Virtual Private 
Network) of low cost using the Internet has increased with the spread of the Internet which can 
be used. This technique builds a dedicated network on the Internet virtually using the function of 
the lower layer of IP which IP (Internet Protocol) network offers, or IP. With this technique, also 
on IP network, it is safe and the network which was isolated from the external network and 
which can perform a certain QA can be built. 

[0003] As a method which realizes VPN, it encapsulates at the entry of the network of the 
Internet Service Provider (hereafter referred to as ISP) which offers VPN, and there is a method 
which transmits based on this encapsulated header and transmits with the method which 
removes a capsule header at a network outlet on the network of ISP. By using the capsulation 
header of a VPN proper, VPN to which security was secured can consist of the interior of the 
Internet. As a concrete protocol of this capsulation, there are methods, such as IP capsulation, 
and MPOA (Multi Protocol OverATM), MPLS (Multi Protocol Label Switching), and the 
standardization is advanced in standardization organizations, such as a May, 2000 current and 
IETF. 
[0004] 

[Problem(s) to be Solved by the Invention] There are a global IP address and a private IP 
address in an IP address. A company can define a private IP address freely to a global IP 
address being what is globally set to a meaning. With the network in a company, a private IP 
address is used in many cases. Therefore, when a company uses a VPN service, it is desirable 
that a private IP address can be used. In this case, the same IP address may be used among two 
or more VPN. When the IP address between two or more VPN carries out batting, in order to 
process the packet of each VPN correctly, it is necessary, as for the router (for it to be 
hereafter called a VPN edge router) which holds LAN (Local Area Network) which is located in 
the entry of an ISP network and belongs to VPN, to hold the routing table for every VPN. A VPN 
edge router will Judge whether it is a packet from LAN to which the packet belongs to which 
VPN, if a packet is received. Then, a VPN edge router searches the routing table for the VPN 
concerned, and performs decision of the destination in the network in ISP, and capsulation. Since 
the VPN edge router holds routing table for every VPN, a VPN edge router cannot mix up a 
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packet with the same destination IP address received from different VPN. but can transmit it 
correctly. 

[0005] As a method which identifies said VPN, per user circuit interface, VPN-ID for identifying 
VPN uniquely is assigned, and there is a method which performs VPN discernment by this VPN- 
ID as indicated by ''the Nikkei communication", the October 18, 1999 issue, and p.100, for 
example. That is, the discernment unit of VPN will be called every physical interface. In this 
case, even in VPN, one physical interface needs to correspond. 

[0006] However, in the aforementioned method, from a company network to the ISP network 
needs to be connected by one physical circuit. Moreover, only the number of the VPN needs to 
prepare a physical circuit to connect one company network with two or more VPN. Furthermore, 
as for a VPN edge router, only the number of VPN to hold needs to hold a physical interface. For 
this reason, when the number of VPN which a VPN edge router holds becomes large, there is a 
problem that the number of physical interfaces of a VPN edge router and the number of the 
routers itself also become large. 

[0007] When using an ATM network, a frame relay, etc. which another ISP or the another carrier 
as an access means to an ISP network which performs a VPN service from a company network 
offers, since multiplex [ of two or more logical channels ] is carried out into one physical 
interface, there is also a problem that a physical interface cannot perform VPN discernment at 
the entry of ISP. 

[0008] The purpose of this invention is to enable VPN discernment using the logical channel 
number multiplexed by the physical interface. 

[0009] Moreover, other purposes of this invention are making it possible to perform VPN 
discernment using the suitable VPN identification information corresponding to each protocol, 
even when using the protocol with which plurality differs as a lower layer of IP, in case a router 
holds LAN. 
[0010] 

[Means for Solving the Problem] In order to solve said technical problem, the VPN edge router of 
this invention identifies VPN using the channel number for identifying the logical channel 
multiplexed by the physical interface. As a logical channel number, the information on the lower 
layer of IP, for example, the information equivalent to the layer 2 specified with the OSI model, is 
used. When some examples of a logical channel number are given, the lower layer of an IP packet 
is ATM, and a lower layer is a Frame Relay about header information, such as VPI and VCI, DLCI 
can be used as a logical channel number. Moreover, when the IP packet is encapsulated by the 
L2TP header specified by L2TP (Layer2 Tunneling Protocol), the information in a L2TP capsule 
header (Tunnel ID, session ID, etc.) can be used as a logical channel number. VLAN as which a 
lower layer is specified by IEEE802.1Q with Ethernet When discernment of VPN is performed 
using Tag, VLANTag can be used as said logical channel number. When the IP packet is 
encapsulated for the capsule information specified by the PPP Over Ethernet capsulation 
method, the capsule information (session ID etc.) specified by the PPP Over Ethernet 
capsulation method can be used as a logical channel number, 

[001 1] Furthermore, the VPN identifier setting table for setting the identifier used for VPN 
discernment as a VPN edge router is prepared. In order that the manager of ISP who manages a 
VPN edge router may enable it to perform this setup, a user interface is prepared in a VPN edge 
router. If the case where the lower layer of IP is ATM is explained to an example, when a 
physical interface will perform VPN discernment, it is set as said VPN identifier setting table with 
a physical interface. Moreover, in performing VPN discernment by VPI and VGI, it sets it as said 
VPN identifier setting table with VPI and VGI. 

[001 2] The interface card unit which holds two or more circuits for which you may carry out as 
every physical interface, and the protocol same as a lower layer is used is sufficient as the 
setting unit of a VPN identifier setting table. Moreover, when two or more protocols are 
multiplexed as a lower layer in one physical interface (for example, circuit by which Time Division 
Multiplexing of the PPP is carried out to the Frame Relay), the combination of a physical 
interface and the protocol of the lower layer of IP is sufficient as the setting unit. 
[0013] In case ISP holds VPN, actuation of a VPN edge router is concretely explained to an 
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example for the case where use ATM for the lower layer of IP and VPI and VCI are used as a 
VPN identifier. A VPN edge router will determine first a VPN identifier (in this example, set up 
with VPI and VCI), and the VPN discernment table which should be searched according to a 
setup of a VPN identifier setting table, if a packet is received. In this example, a VPN edge 
router will search the table in which correspondence with VPI, VCI, and VPN is shown. A VPN 
edge router judges to which VPN VPI and VCI are used as a search key, a VPN discernment 
table is searched, and the packet which received belongs. After the judgment is completed, a 
VPN edge router searches the routing table for VPN to which the packet which received 
belongs, determines the next destination in an ISP network, and generates capsulation header 
information used in a network for VPN discernment. A VPN edge router sends out a packet to 
the next destination which gave and determined header information as the packet. 
[0014] Like the above explanation, in order to perform VPN discernment using the logical 
channel number multiplexed by the physical interface, it is not necessary to prepare a physical 
interface for a VPN edge router for every VPN by this invention. Moreover, only the number of 
the VPN does not have the need that only the number of VPN prepares a physical circuit that 
what is necessary is just to prepare a logical channel to connect one company network with two 
or more VPN. Moreover, since VPN discernment is performed by the logical channel when using 
an ATM network, a frame relay, etc. which another ISP or the another carrier as an access 
means to an ISP network which performs a VPN service from a company network offers, VPN is 
realizable. 

[0015] Furthermore, according to this invention, since a VPN identifier can be chosen for every 
protocol of the lower layer of IP and the VPN identifier can be set as a VPN identifier setting 
table, in case the manager of ISP holds VPN, he can use various protocols for a lower layer. 
[0016] 

[Embodiment of the Invention] Drawing 1 is drawing for explaining one example of VPN 
constituted using the VPN edge router of this invention. Below, a lower layer shall mean the 
protocol which encapsulates an IP packet. Moreover, also when you encapsulate an IP packet by 
IP header, suppose for convenience that this capsule header is written as a header of a lower 
layer. 

[0017] An ISP network (5) has the edge router (9 10) located in a network boundary, and the 
core router (1 7) located in a network core. In drawing 1 , although, as for the core router (1 7), 
only one is shown, the number is not limited to this. Inside an ISP network (5), capsulation shall 
be performed by MPLS (based on ATM) and VPN shall be realized. As mentioned above, the 
method of capsulation is not restricted to this. An ISP network (5) holds LAN1 (1) and LAN2 (2) 
through an edge router (9), and holds LANS (3) and LAN4 (4) through an edge router (10). LAN1 
(1) and LANS (3) are LANs of the same company A, and constitute VPN among these LANs. 
Moreover, LAN2 (2) and LAN4 (4) are LANs of the same company B, and constitute VPN also 
among these LANs. VPN of Company A and Company B will be called VPNA (7) and VPNB (8), 
respectively. 

[0018] An ISP network (5) is logically multiplexed by the circuit (11) through the ATM network 
(6) which another ISP or an another carrier offers, and LAN1 and LAN2 are connected to the 
edge router (9). The physical interface of a circuit (11) and an edge router (9) is set to (12). A 
physical interface is the semantics of the node of a router and a circuit. On the other hand, 
LANS (3) and LAN4 (4) are connected to the edge router (10) through a circuit (13) and (14) 
using PCS (PPP Over SONET) specified by RFC2615, respectively. The physical interface of a 
circuit (13), (14), and an edge router is set to (15) and (16), respectively. 
[0019] In this example, VPI and VCI are used as an identifier which identifies VPN to which 
LAN1 and LAN2 belong. In the VPN identifier setting table prepared in the edge router (9), it is 
set to the entry corresponding to a physical interface (1 2) with VPI and VCI. The number given 
to the physical interface as an identifier which identifies VPN to which LANS and LAN4 belong is 
used for an edge router (10). In the VPN identifier setting table prepared in the edge router (10), 
it is set to the entry corresponding to a physical interface (15) and (16) with a physical interface. 
A VPN identifier setting table is mentioned later. 

[0020] Moreover, in the edge router (9), the VPN discernment table showing the correspondence 
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relation between a VPN identifier and the information (henceforth a VPN number) which shows 
whether the packet which has the VPN identifier concerned belongs to which VPN is prepared. 
Above VPNA and VPNB corresponds to a VPN number. Furthermore, in the edge router (9), the 
routing table showing the relation between a destination IP address and the capsule header 
information on the method way of an output and an output packet is prepared. The thing for 
VPNA in this routing table and the thing for VPNB are prepared. It is later mentioned also about 
a VPN discernment table and routing table. 

[0021] An edge router (9) will determine to use VPI and VCI as a VPN identifier according to a 
setup of a VPN identifier setting table, if the IP packet addressed to LANS transmitted from 
LAN1 is received. After determining a VPN identifier, it judges with an edge router (9) being a 
packet to which the VPN discernment table in which correspondence with VPI, VCI, and VPN is 
shown is searched, and the packet concerned belongs to VPNA. Next, an edge router (9) 
searches the routing table for VPNA by using a destination IP address as a search key, 
determines the core router (17) of degree the destination, and determines the capsule header of 
the packet belonging to VPNA for a core router. The packet to which this capsule header was 
given is transmitted to a core router (1 7). 

[0022] The core router (17) has the routing table showing correspondence relation with degree 
the destination with a capsule header, i.e., VPI and VCI, uses the capsule header of a receive 
packet as a search key, determines degree the destination (edge router (10)) and the following 
capsule header, gives said capsule header, and transmits to an edge router (10). 
[0023] An edge router (10) judges that it is the same configuration as an edge router (9), and is 
the packet which uses the capsule header of a receive packet as a search key, performs VPN 
discernment like an edge router (9), and belongs to VPNA. Next, the routing table for VPNA is 
searched by using a destination IP address as a search key, the destination is determined, a 
capsule header is removed, and a packet is transmitted to LANS. 

[0024] Since an edge router (9) identifies VPN by the logical channel number by which multiplex 
was carried out to the physical interface and searches the routing table of the VPN concerned, 
it becomes possible [ identifying VPN by which multiplex was logically carried out to one circuit ]. 
moreover, the IP address which Company A uses by this — ** — even when the IP address 
which Company B uses carries out batting, the transfer to the right destination is attained. 
[0025] Although transmission is performed by the same procedure as the above-mentioned case 
also when transmitting a packet to LAN2 from LAN4 in VPNB, the edge router (10) which 
received the IP packet addressed to LAN2 transmitted from LAN4 differs from the case where 
the point of using a physical interface as a VPN identifier is the above. 

[0026] Drawing 2 is drawing for explaining the modification of the example shown in drawing 1 . In 
this example, LAN1 and LAN2 are directly held in the multiplexer (20) in an ISP network (5) 
through another circuit (18) and (19). In multiplexer (20), VPNA, different VPI for every VPNB, 
and VCI are assigned. An edge router (9) performs VPN discernment like the case of drawing 1 
using VPI and VCI. 

[0027] Drawing S is drawing for explaining other modifications of the example shown in drawing 
1. 

[0028] LANS (21) is added to the network configuration shown in drawing 1 , and VPNB consists 
of drawing 3 between LAN2, LAN4, and LANS. LANS (21) is connected to the edge router (9) by 
the circuit (22) using PCS. The physical interface of a circuit (22) and an edge router is set to 
(2S). 

[0029] VPI and VCI are used for an edge router (9) as an identifier which identifies VPN to which 
LAN1 and LAN2 belong like explanation of drawing 1 . On the other hand, a physical interface is 
used for an edge router (9) as an identifier which identifies VPN to which LANS belongs. It is set 
to the VPN identifier setting table in an edge router (9) with a physical interface by the entry 
corresponding to a physical interface (2S). In this example, two kinds of VPN discernment tables 
of the VPN discernment table in which correspondence with VPI. VCI. and VPN is shown, and 
the VPN discernment table in which correspondence with a physical interface and VPN is shown 
are prepared in the edge router (9). The detail is mentioned later. 

[OOSO] For example, when the IP packet addressed to LAN4 transmitted from LANS is received. 
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an edge router (9) determines to use the number of a physical interface as a VPN identifier 
according to a setup of a VPN identifier setting table. After determining a VPN identifier, an edge 
router (9) searches the VPN discernment table in which correspondence with a physical 
interface and VPN is shown by using the number of a physical interface as a search key, and 
judges that it is the packet to which the IP packet belongs to VPNB. Next, the routing table for 
VPNB is searched by using a destination IP address as a search key, the core router (17) of 
degree the destination is determined, and the capsule header of the packet transmitted to the 
determined core router is determined. This capsule header is given to a packet and it transmits 
to a core router (1 7). 

[0031] In this example, the VPN identifier was defined for every different underlying protocol, and 
the VPN discernment table is prepared in each VPN identifier correspondence. By doing in this 
way, the degree of freedom at the time of corresponding to an underlying protocol which is 
different with one router increases. That is, if only according to this example it sets up the VPN 
identifier in a VPN identifier setting table and sets up the VPN discernment table corresponding 
to the VPN identifier according to the underlying protocol which it is going to hold in an edge 
router, it becomes possible to hold various underlying protocols in an edge router. 
[0032] Next, the detail of the VPN edge router of this invention is explained. When VPN is 
constituted, a network configuration can consider configurations various besides what was 
shown in drawing 1 - drawing 3 . Then, it limits to the configuration of the VPN edge router in 
the case of constituting the network of drawing 1 - drawing 3 , and does not explain, but, more 
generally the configuration of this invention VPN edge router is explained. 

[0033] The example of 1 configuration of a VPN edge router (9) is explained using drawing 8 from 
drawing 4 . The configuration of a VPN edge router (10) is the same as that of this. 
[0034] Drawing 4 is drawing showing the example of 1 configuration of the VPN edge router (9) 
of this invention. It connects with the lower layer processing section (53 54), the packet layer 
processing section (52), and a switch (51), and a control section (50) performs control, routing 
processing, etc. of the whole VPN edge router. The lower layer processing section (53 54) 
performs termination of the lower layer of IP while holding a circuit (55 56). The packet layer 
processing section (52) determines the destination of a packet for the information and the IP 
packet of a lower layer using the information and the header information of an IP packet of 
reception and its lower layer from the lower layer processing section (53 54). The switch (51) 
has two or more input/output port, and those ports are connected with the packet layer 
processing section. A switch (51) consists of crossbar switches. A switch (51) will output the 
packet to the output port corresponding to the destination of the packet determined in the 
packet layer processing section (52), if a packet is received from the packet layer processing 
section (52). A control terminal (57) is connected to said control section (50). The manager of a 
router is able to perform a setup of the VPN identifier setting table in a router, a VPN 
discernment table, and routing table etc. with said control terminal. The physical interface 
numbers 1, 2, 3, and 4 are assigned at the node of the receiving circuit 55-1, 55-2, 55-3 and 55- 
4, and a router (9), respectively. 

[0035] Drawing 5 is drawing showing the example of 1 configuration of the packet layer 
processing section (52). The lower layer processing section IF (100 106), Switch IF (103 104), 
and a control section IF (1 10) are an interface with the lower layer processing section (53 54), an 
interface with a switch (51), and an interface with a control section (50), respectively. One of the 
descriptions of this example is in the point of having prepared a VPN identifier setting table 
(150), a VPN discernment table (151), and the routing table (152) for VPN, These are constituted 
on memory. These may be constituted on memory physically different, respectively, and may be 
constituted by the field to which it differs on the same memory. The difference in the method of 
this configuration is not essential when carrying out this invention. The function and 
configuration of a block of others which were not explained a VPN identifier setting table (150), a 
VPN discernment table (151), routing table (152), and here are combined with packet processing 
actuation of the router (9) explained below, and is explained. 

[0036] A packet is received from the circuit (55) which the lower layer processing section (53) 
has held, the case where a packet is transmitted to the circuit (56) which the lower layer 
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processing section (54) has held is lengthened for an example, and packet processing of a router 
(9) is explained. 

[0037] The lower layer processing section (53) will carry out termination of the protocol of the 
lower layer of IP, if a packet is received from LAN. The lower layer processing section (53) 
transmits the capsule header information on the lower layer used as the physical interface 
number (it is hereafter called the receiving physics interface number) and the protocol 
classification of a lower layer which received the packet with the IP packet, and a VPN identifier 
etc. to the packet layer processing section (52). 

[0038] The lower layer processing section interface (100) in the packet layer processing section 
(52) transmits the capsule header information on the lower layer used as the protocol 
classification and the VPN identifier of the IP packet transmitted from the lower layer processing 
section (53), a receiving physics interface number, and a lower layer to the packet transfer 
processing section (101). The packet transfer processing section (101) extracts IP header 
information from the IP packet which received, and transmits the capsule header information on 
the lower layer used as the protocol classification and the VPN identifier of this IP header 
information, a receiving physics interface number, and a lower layer to VPN discernment and the 
routing table retrieval processing section (102). An IP packet body is temporarily accumulated 
into the packet transfer processing section (101). 

[0039] VPN discernment and the routing table retrieval processing section (102) search a VPN 
identifier setting table (150) first by using protocol classification of a receiving physics interface 
number and a lower layer etc. as a search key, and determines a VPN identifier. 
[0040] Drawing 6 shows the example of 1 configuration of a VPN identifier setting table (150). 
Each entry has a physical interface number (200), a lower layer protocol (203), and a VPN 
identifier (201). Although the lower layer protocol has established the field of CLP which shows 
the transfer priority of a packet in the entry of ATM, this field may not exist. The manager of an 
edge router (9) can set up a VPN identifier from a control terminal (57) as above--mentioned. 
VPN discernment and the routing table retrieval processing section (102) search using a 
receiving physics interface number as a search key, and determines a VPN identifier (201). For 
example, when a receiving physical interface number is 1, a VPN identifier serves as VPI and 
VCI, and when a receiving physical interface number is 3. a VPN identifier serves as a physical 
interface number. Like this example, when preparing the CLP field, the combination of VPI, VCI, 
and CLP and the combination of a physical interface number and CLP may be used as a VPN 
identifier. About the merit at the time of including CLP (204) in a VPN identifier, it mentions 
later. When multiplex [ of the packet belonging to two or more VPN ] is carried out logically and 
it is transmitted to one physical interface, the packet cannot distinguish to which VPN it belongs 
from a receiving physical interface number. However, if VPI and VCI are used for a VPN identifier 
when the lower layer is ATM, it will become possible to identify to which VPN the packet 
belongs. When only the packet belonging to one VPN is transmitted to one physical interface, it 
is possible to identify VPN by the physical interface number. As a search key, the combination of 
the protocol (203) of a lower layer and a physical interface number (201) may be used. For 
example, the circuit connected to the physical interface number 4 is a Time-Division- 
Multiplexing circuit, and suppose that multiplex [ of the packet which used the Frame Relay for 
said circuit as a protocol of a lower layer and the packet using a PPP (Point to Point Protocol) 
protocol ] is carried out. Moreover, to the entry of a Frame Relay, DLCI is set up as a VPN 
discernment key and a lower layer protocol presupposes that the time slot number is set up for 
the lower layer protocol as a VPN discernment key to the entry of PPP. In this case, even if it 
searches only the receiving physical interface number 4 as a search key, it does not become 
settled uniquely whether a VPN identifier is DLCI or it is a time slot number. Then, a VPN 
identifier is searched with the combination of a receiving physical interface number and a lower 
layer protocol in this case. 

[0041] If a VPN identifier is determined, VPN discernment and the routing table retrieval 
processing section will search a VPN discernment table (151) by using the VPN identifier as a 
search key, and will determine VPN to which the receive packet belongs. 
[0042] Drawing 7 (a) and (b) show the example of 1 configuration of a VPN discernment table 
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(151) , Also in which VPN discernment table, each entry has a VPN identifier (201) and a VPN 
number (250). 

[0043] Drawing 7 (a) shows the example of the table which uses VPI and VCI as a VPN identifier 
(201). It is not necessary to prepare the CLP field (204) of drawing 7 (a), and the priority 
information field (251) in equipment. The priority information field (251) in equipment are the field 
which shows the priority information on the packet processing in equipment. According to the 
VPN identifier determined by retrieval of the aforementioned VPN identifier setting table as a 
search key, VPN discernment and the routing table retrieval processing section (1 02) search 
using the VPN identification information in a packet header as a search key, and determines a 
VPN number (250). Like this example, when establishing the CLP field (204) and the priority 
information field (251) in equipment in a VPN discernment table (151). as a search key, the 
combination of CLP (204), VPI. and VCI which shows the transfer priority of a packet may be 
used. By including CLP in a search key, different priority information in equipment can be defined 
to the packet belonging to the same VPN number. For example, "VPI, VCI=a" and in the case of 
"CLP=0'', "priority in equipment =a", "VPI. VCI=a", and in the case of "CLP=1", priority 
information in equipment which is different to the packet belonging to the same VPN number as 
shown in "priority in equipment =b" can be defined. 

[0044] Drawing 7 (b) shows the example of the table which uses a physical interface number 
(252) as a VPN identifier (201), If the priority control of packet processing is not performed, it is 
not necessary to prepare the priority information field (251) in equipment of drawing 7 (b). 
[0045] What is necessary is just to constitute the same table as drawing 7 (a) and (b), when VPN 
identifiers other than the above, for example, DLCI, a time slot number, etc. are used. That is, a 
VPN discernment table (151) is prepared for every VPN identifier, and these setup is set up from 
a control terminal (54). The VPN discernment table (151) prepared for every VPN identifier may 
be constituted on the same memory, and may be constituted on different memory, respectively. 
[0046] If a VPN number is determined, VPN discernment and the routing table retrieval 
processing section will search the routing table (152) for VPN corresponding to the VPN number, 
and will determine the output capsule header information for VPN added to the packet belonging 
to the method way of an output, and its VPN number. 

[0047] Drawing 8 shows the example of 1 configuration of the routing table (152) for VPN. VPN 
discernment and the routing table retrieval processing section (102) hold this routing table (152) 
for VPN for every VPN to hold. The routing table (152) for VPN prepared for every VPN of this 
may be constituted on the same memory, and may be constituted on memory different, 
respectively. The routing table (152) for VPN has a destination IP address (300), a method way 
number (301) of an output, and output capsule header information (302). The method way 
number (301) of an output is an identifier in equipment for transmitting a packet to a desired 
interface with a switch etc. Output capsule header information (302) is the capsule header 
information that it uses in an ISP network (5). VPN discernment and the routing table retrieval 
processing section (102) search routing table for VPN corresponding to the VPN number (250) 
determined by retrieval of the aforementioned VPN discernment table, using the destination IP 
address in IP header as a search key, and determines the method way number (301) of an 
output, and output capsule header information (302). In this example, since the routing table 

(152) for VPN is prepared for every VPN, even if the same IP address is used in two or more 
VPN, the method way of a right output can be determined. 

[0048] If the method way number (301) of an output and output capsule header information (302) 
are determined, VPN discernment and the routing table retrieval processing section (102) will 
transmit the method way (301) of an output and output capsule header information (302) which 
were determined to the packet transfer processing section (101). 

[0049] The packet transfer processing section (101) transmits the IP packet body which was 
being accumulated, the method way number (301) of an output, and output capsule header 
information (302) to a switch (51) through Switch IF (103). A switch (51) outputs the IP packet 
body received from the packet transfer processing section (101), and its output capsule header 
information (302) to the output port corresponding to the method way number of an output. 
[0050] The packet layer processing section (52) of the side which receives the IP packet body 
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transmitted from the packet layer processing section connected to the above-mentioned output 
port (52), i.e., the packet layer processing section, (52) and its output capsule header information 
(302) receives them through Switch IF (104). If an IP packet body and its output capsule header 
information (302) are received, the packet transfer processing section (105) will transmit these 
to the lower layer processing section (54) through the lower layer processing section IF (106). If 
an IP packet body and its output capsule header information (302) are received, the lower layer 
processing section (54) will generate a capsule header based on the output capsule header 
information, and will encapsulate an IP packet body by the capsule header, and will transmit the 
encapsulated packet to a core router (1 7). 

[0051] In the above, the example of 1 configuration of VPN edge router equipment was explained 
using drawing 8 from drawing 4 . Even if it is the case where the packet belonging to different 
VPN is transmitted to the same physical interface by using the router equipment of this example, 
it becomes possible to identify VPN to which they belong. Moreover, since the suitable VPN 
identifier corresponding to each underlying protocol can be set as a VPN identifier setting table 
even when the same edge router holds two or more LANs which use the underlying protocol of 
different IP, the degree of freedom of VPN construction increases. 

[0052] Although the direct output of the output capsule header information is carried out as a 
retrieval result of the routing table for VPN, you may make it output an output capsule number in 
this example. This output capsule number is an identifier in equipment for giving a capsule 
header in the lower layer processing section of an output side. In this case, the header 
generation table which made the capsule number and the capsule header the pair is prepared in 
the lower layer processing section of an output side. The lower layer processing section of an 
output side searches a header generation table using a search key and a **3K* capsule number, 
and determines a capsule header. 

[0053] The table shown by this example is a logical table, may use the retrieval algorithm 
represented by the tree structure as a table search method, and may adopt the configuration 
using GAM (Content Addressable Memory), and the method which carries out the sequential 
retrieval of the table. 

[0054] When VPN edge router equipment holds a Time-Division-Multiplexing circuit, the lower 
layer processing section may apply a time slot number besides [ which was explained by this 
example ] each information as information transmitted to the packet layer processing section. In 
this case, a time slot number may be set as a VPN identifier setting table as a VPN identifier. 
Moreover, a time slot number may be used as a search key of a VPN discernment table. 
[0055] VLAN besides [ which was explained by this example as information which the lower layer 
processing section transmits to the packet layer processing section when VPN edge router 
equipment held Ethernet and VLAN capsulation of the packet on Ethernet was carried out 
according to IEEE802.1Q ] each information Tag information may be added. In this case, it is 
VLAN to a VPN identifier setting table as a VPN identifier. Tag information may be set up. 
Moreover, it is VLAN as a search key of a VPN discernment table. Tag information may be used. 
[0056] When the IP packet is encapsulated by the L2TP header specified by L2TP (Layer2 
Tunneling Protocol), each information in a L2TP capsule header (Tunnel ID, session ID, etc.) may 
be set as a VPN identifier setting table as a VPN identifier. 

[0057] Moreover, when the IP packet is encapsulated for the capsule information specified by 
the PPP Over Ethernet capsulation method, the lower layer processing section may add the 
capsule information specified as information transmitted to the packet layer processing section 
by the PPP Over Ethernet capsulation method besides [ which was explained by this example ] 
each information. In this case, the capsule information (session ID etc.) specified on the VPN 
identifier setting table by the PPP Over Ethernet capsulation method may be set up as a VPN 
identifier. 

[0058] Drawing 9 shows other examples of a configuration of the VPN edge router equipment (9) 
of this invention. An interface card (400 401) is a card which holds the circuit using the protocol 
of the same low order layer, respectively. For example, an interface card (400) is an interface 
card for ATM, and holds an ATM circuit (402). Moreover, an interface card (401) is an interface 
card for POS, and holds a POS circuit (403). The interface card (400 401) is removable and, as 
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for the manager of a router, only required quantity can carry the required interface card for low 
order layer protocols. The lower layer processing section (405 406) which performs processing 
peculiar to each lower layer protocol is carried in each interface card. Actuation of the lower 
layer processing section (405 406) is the same as that of the lower layer processing section (53 
54) of drawing 4 . A packet processing card (407) is a card which performs reception and packet 
layer processing for information, such as an IP packet, from said interface card. Each packet 
processing card (407) is removable, and, as for the manager of a router, only required quantity 
can carry it The packet layer processing section (52) explained using drawing 4 and drawing 5 is 
carried in each packet processing card (407). A manager can set up flexibly the configuration of 
the VPN identifier setting table in a packet processing card (407), a VPN discernment table, and 
the routing table for VPN from a control terminal (57) according to the classification of the 
interface card to hold, and the configuration of the access network between LAN and an 
interface card. Packet processing actuation of the VPN edge router equipment of this example is 
the same as the actuation explained using drawing 8 from drawing 4 . 

[0059] Drawing 10 to drawing 12 is drawing showing the relation between the interface card held 
in the packet processing card (407) of drawing 9 , and the VPN identifier setting table held at a 
packet processing card, a VPN discernment table and the routing table for VPN. Drawing 1 2 
indicates only an interface card and a packet processing card to be LANs held in an edge router 
among the components of an edge router (9) from drawing 10 . Moreover, the VPN identifier 
setting table in a packet processing card, a VPN discernment table, and the routing table for 
VPN are logical. Drawing 12 shows the case where the same VPN identifier is used, from drawing 
10 to all the physical interfaces in the same interface card. For this reason, since it is not 
necessary to set up a physical interface number as a search key of a VPN identifier setting 
table, by drawing 12 , the physical interface number as that search key is omitted from drawing 
10 . What is necessary is Just to use a physical interface as a search key of a VPN identifier 
setting table as mentioned above, when a different VPN identifier is used within the same 
interface card. 

[0060] Drawing 1 0 shows the example of 1 configuration of the VPN identifier setting table in a 
packet processing card in case the interface card (400) for ATM is held, a VPN discernment 
table, and the routing table for VPN to a packet processing card (407). LAN1 (450) belongs to 
VPNA and presupposes that LAN2 (451) is belonged to VPNB. Multiplex [ of the packet from 
LAN1 and LAN2 ] is carried out with multiplexer (452), and it is held in the interface card (400) 
for ATM through a circuit (453). In case multiplex is carried out, suppose that the value a and b 
is assigned to the packet as VPI and a VCI from LAN1 and LAN2, respectively. VPI and VCI are 
used for VPN discernment in this example. VPI and VCI are set to the VPN identifier setting 
table (455) in a packet processing card (407) as a VPN identifier. VPI and VCI are set to a VPN 
discernment table (456) as a search key. As routing table for VPN, the routing table (457) for 
VPNA and the routing table (458) for VPNB are prepared. For example, if a packet is received 
from LAN1, the lower layer processing section (405) in the interface card (400) for ATM will 
carry out termination of the ATM protocol, and will transmit an IP packet body and VPI and VCI, 
a physical interface number, etc. to a packet processing card (407). The VPN discernment and 
the routing table retrieval processing section in a packet processing card (407) search a VPN 
identifier setting table (455), and determines to use VPI and VCI as a VPN identifier. Next, a 
VPN discernment table (456) is searched using VPI of a receive packet, the value of VCI, and 
"a'', and it judges that a receive packet belongs to VPNA. Next, the routing table (457) for VPNA 
is searched and the method way of an output and output capsule header information are 
determined. 

[0061] Drawing 1 1 shows the example of 1 configuration of the VPN identifier setting table in a 
packet processing card in case the interface card (401) for PCS is held, a VPN discernment 
table, and the routing table for VPN to a packet processing card (407). 

[0062] LAN1 (450) belongs to VPNA and presupposes that LAN2 (451) is belonged to VPNB. 
LAN1 and LAN2 are held in the interface card (401) for PCS through a circuit (500) and (501), 
respectively. The physical interface number of a circuit (500) and a circuit (501), and the 
interface card (401) for PCS is set to 1 and 2, respectively. In this case, in order to use a 
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physical interface for VPN discernment, a physical interface number is set to the VPN identifier 
setting table (455) in a packet processing card (407) as a VPN identifier. A physical interface 
number is set to a VPN discernment table (456) as a search key. As routing table for VPN, the 
routing table (457) for VPNA and the routing table (458) for VPNB are prepared. The processing 
in a packet processing card (407) is the same as the processing explained using drawing 10 . 
However, the points using VPI and not VCI but a physical interface as a VPN identifier differ. 
[0063] Although drawing 12 is not illustrated to drawing 9 , it shows the example of 1 
configuration of the VPN identifier setting table in a packet processing card in case the interface 
card (550) for Time-Division-Multiplexing circuits is held, a VPN discernment table, and the 
routing table for VPN to a packet processing card (407). LAN1 (450), LAN2 (451), and LAN3(551) 
LAN4 (552) presuppose that it belongs to VPNA, VPNB, VPNC, and VPND, respectively. The 
underlying protocol of LAN1 and LAN2 is made into a Frame Relay, and the underlying protocol 
of LANS and LAN4 is set to PPP (Point to Point Protocol). 10 and 20 are assigned to a packet 
as DLCI from LAN1 and LAN2, respectively, and those packets are multiplexed by the circuit 
(554) in Frame Relay multiplexer (553). Furthermore, in a time division multiplexer (555), multiplex 
[ of a circuit (554), (556), and (557) ] is carried out to a circuit (558). Under the present 
circumstances, suppose that time slot numbers 1, 2, and 3 are assigned to the data of a circuit 
(554), (556), and (557), respectively. Suppose that DLCI is used as a VPN identifier to LAN1 and 
LAN2, and a time slot number is used as a VPN identifier to LAN3 and LAN4. In this case, to the 
entry whose lower layer protocol (559) in a VPN identifier setting table (455) is a Frame Relay, 
DLCI (560) is set up as a VPN identifier. Moreover, to the entry whose lower layer is PPP, a time 
slot number (561) is set up as a VPN identifier. As a VPN discernment table, two tables (562), 
i.e., the VPN discernment table showing correspondence of DLCI and a VPN number, and the 
VPN discernment table (563) showing correspondence of a time slot number and a VPN number 
are prepared. Moreover, the routing table (457) for VPNA, the routing table (458) for VPNB, the 
routing table (564) for VPNC, and the routing table (565) for VPND are prepared as routing table 
for VPN. The processing in a packet processing card (407) is the same as the processing 
explained using drawing 10 . However, it differs in that a lower layer protocol (559) is used as a 
search key at the time of VPN identifier setting table retrieval. Moreover, it differs in that DLCI 
is used as a VPN identifier about the packet which received from LAN1 and LAN2, and a time 
slot number is used about the packet which received from LAN3 and LAN4 as a result of VPN 
identifier setting table retrieval. 

[0064] Although the example in which one packet processing card holds one interface card in 
drawing 12 was explained from drawing 9 , a packet processing card is very good in the 
configuration which holds two or more interface cards. You may be [ from which two or more 
interface cards to hold differ in that case ] for underlying protocols. 

[0065] Drawing 13 shows the example of 1 configuration of the VPN identifier setting table in a 
packet processing card in case an interface card for underlying protocols which is different on a 
packet processing card (407) is held, a VPN discernment table, and the routing table for VPN. An 
interface card (400) and (401) carry out to the object for ATM, and PCS, respectively. Drawing 
13 shows the case where a VPN identifier is the same, to all the physical interfaces in the same 
interface card. It is ***5ic** by which the ******** card numbers 1 and 2 are assigned to each 
interface card (400) and (401) in order that a packet transfer card may hold two or more 
interface cards by this example. Moreover, a card number (602) is set up as a search key of a 
VPN identifier setting table (455). LAN1 (450), LAN2 (451), and LAN3(551) LAN4 (552) 
presuppose that it belongs to VPNA, VPNB, VPNC, and VPND, respectively. Multiplex [ of the 
packet from LAN1 and LAN2 ] is carried out with multiplexer (452), and it is held in the interface 
card (400) for ATM through a circuit (453). In case multiplex is carried out, the value a and b 
shall be assigned to a packet as VPI and a VCI from LAN1 and LAN2, respectively. In this case, 
what is necessary is just to use VPI and VCI for VPN discernment. To the entry (603) of a card 
number 1 in a VPN identifier setting table (455), VPI and VCI are set up as a VPN identifier. 
LAN3 and LAN4 are held in the interface card (401) for PCS through a circuit (500) and (501), 
respectively. The physical interface number of a circuit (500), and a (501) and the interface card 
(401) for PCS is set to 1 and 2, respectively. In this case, what is necessary is just to use a 
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physical interface for VPN discernment. To the entry (604) of a card number 2 in a VPN 
identifier setting table (455), a physical interface is set up as a VPN identifier. As a VPN 
discernment table, the table (600) showing correspondence of VPI, VCI, and a VPN number and 
the table (601) showing correspondence of a physical interface number and a VPN number are 
prepared. As routing table for VPN, the routing table (457) for VPNA, the routing table (458) for 
VPNB, the routing table (564) for VPNC, and the routing table (565) for VPND are prepared. The 
processing in a packet processing card (407) is the same as the processing explained using 
drawing 10 , However, it differs in that a card number (602) is used as a search key at the time 
of VPN identifier setting table retrieval. Here, although the case where ATM and POS were held 
was shown, it is not restricted to this combination. For example, it is also possible to change the 
interface card for POS to the interface card for FR. In this case, you may make it the packet 
from LANS and LAN4 identify VPN by DLCI so that multiplex may be carried out to one circuit 
and it may be inputted into the interface card for FR like LAN1 and LAN2. 
[0066] As mentioned above, as explained using drawing 13 from drawing 9 , according to the 
router equipment of this example, a manager can set up flexibly the configuration of the VPN 
identifier setting table in a packet processing card (407), a VPN discernment table, and the 
routing table for VPN from a control terminal (57) according to the classification of the interface 
card to hold. Moreover, since VPN is identified by the logical channel number by which multiplex 
was carried out to the physical interface, it becomes possible to identify VPN by which multiplex 
was logically carried out to one circuit. 

[0067] An example of the configuration procedure of a packet processing card (407) at the time 
of equipping drawing 14 with an interface card is shown. After a VPN edge router (9) is equipped 
with an interface card, the VPN identifier setting table (455) in a packet processing card (407) is 
set up (701 702). A manager can set up a setup of a VPN identifier setting table freely by 
classification of the Interface card with which it equips. Next, a VPN discernment table is set up 
for every set-up VPN identifier (703). Routing table is set up for every VPN (704). 
[0068] In case a setup of a VPN identifier equips a packet processing card with an interface 
card, it communicates between an interface card and a packet processing card, judges 
automatically the protocol of the lower layer of the IP packet in which an interface card carries 
out termination, and you may make it notify it to a packet processing card. The identification 
information specified corresponding to the protocol of the notified lower layer can be set 
automatically on a VPN identifier setting table. 

[0069] In the above, actuation of the VPN edge router of this invention was explained using 
drawing 1 — drawing 14 . The flow of operation common to these is shown in drawing 15 . 
[0070] If the packet which encapsulated the IP packet from LAN is received (801), a VPN edge 
router will search a VPN identifier setting table (802), and will determine the VPN identifier of a 
receive packet (803). As a VPN identifier, although logical channel identifiers, such as VPI and 
VCI, are used, according to the underlying protocol to hold, you may use it combining this, a 
physical interface number, etc. Next, a VPN discernment table is searched by using the 
determined VPN identifier as a search key (804), and VPN to which a receive packet belongs is 
determined (805). For example, when VPN identifiers are VPI and VCI, a VPN discernment table 
is searched by using as a search key VPI and VCI which were assigned to the receive packet, 
and VPN to which a receive packet belongs is determined. The determined routing table for VPN 
is searched (806), and the method way of an output and the capsule header for an output are 
determined (807). 
[0071] 

[Effect of the Invention] By using the router of this invention, VPN is discriminable using the 
logical channel number multiplexed by the physical interface. Therefore, the number of VPN to 
hold can be increased, without increasing a physical circuit. 

[0072] Moreover, since the suitable VPN identifier corresponding to each protocol can be set up 
even when two or more LANs which a router holds use the underlying protocol of IP different, 
respectively, VPN discernment can be performed. 
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DESCRIPTION OF DRAWINGS 



[Brief Description of the Drawings] 

[Drawing 1] It is drawing for explaining one example of VPN constituted using the VPN edge 
router of this invention, 

[Drawing 2] It is drawing for explaining the modification of the example shown in drawing 1 . 
[Drawing 31 It is drawing for explaining other modifications of the example shown in drawing 1 . 
[Drawing 4] It is drawing showing the example of 1 configuration of the VPN edge router of this 
invention. 

[Drawing 5] It is drawing showing the example of 1 configuration of the packet layer processing 
section. 

[Drawing 6] It is drawing showing the example of 1 configuration of a VPN identifier setting table 
(150). 

[Drawing 7] It is drawing showing the example of 1 configuration of a VPN discernment table. 
[Drawing 8] It is drawing showing the example of 1 configuration of the routing table for VPN. 
[Drawing 9] It is drawing showing other examples of a configuration of the VPN edge router 
equipment of this invention. 

[Drawing 10] It is drawing showing the example of 1 configuration of the VPN identifier setting 
table in a packet processing card in case the interface card for ATM is held, a VPN discernment 
table, and the routing table for VPN on a packet processing card. 

[Drawing 11] It is drawing showing the example of 1 configuration of the VPN identifier setting 
table in a packet processing card in case the interface card for PCS is held, a VPN discernment 
table, and the routing table for VPN on a packet processing card. 

[Drawing 12] It is drawing showing the example of 1 configuration of the VPN identifier setting 
table in a packet processing card in case the interface card for Time-Division-Multiplexing 
circuits is held, a VPN discernment table, and the routing table for VPN on a packet processing 
card. 

[Drawing 13] It is drawing showing the example of 1 configuration of the VPN identifier setting 
table in a packet processing card in case an interface card for underlying protocols which is 
different on a packet processing card is held, a VPN discernment table, and the routing table for 
VPN. 

[Drawing 14] It is drawing showing an example of the configuration procedure of a packet 
processing card. 

[Drawing 15] It is the flow chart which shows the flow of the VPN edge router of this invention 
of operation. 

[Description of Notations] 

5 [ — A switch, 52 / — 53 The packet layer processing section 54 / — 1 01 The lower layer 
processing section 105 / — The packet transfer processing section 102 / — VPN discernment 
and the routing table retrieval processing section, 150 / — A VPN identifier setting table 151 / - 

- A VPN discernment table, 152 / — Routing table, 400 / — The interface card for ATM, 401 / 

— The interface card for POS, 407 / — Packet processing card. ] — An ISP network, 9 — A 
VPN edge router, 50 — A control section, 51 



http:/ / www4.ipdl.inpit.go.jp/cgi-bin/tran_web_cgi_ejje 



2007/07/04 



JP,2001-345864.A LDESCRIPTION OF DRAWINGS] 2/2 ^— i? 



[Translation done.] 



http:/ / www4.ipdl.inpit.goJp/ cgi-bin/tran_web_cgi_ejje 



2007/07/04 



JP,2001-345864,A [DRAWINGS] 



1/7 



* NOTICES * 

JPO and INPiT are not responsible for any 
damages caused by the use of this translation. 

1 This document has been translated by computer. So the translation may not reflect the original 
precisely. 

2.**** shows the word which can not be translated. 
3.1n the drawings, any words are not translated. 



DRAWINGS 



[Drawing 1] 

1 7 3 




[Drawing 8] 



http;//www4.ipdl.inpit.go.jp/cgi-bin/tran_web^cgi_eije 2007/07/04 



JP,2001-345864,A [DRAWINGS] 



B8 



30O 


307 


302 








a. a. a. a 


10 




U K k K 
K7. D. D. D 


■1 H 

1 1 


l> 








n, n. n. n 


15 


n 



[Drawing 14] 

701 



1 ' 702 



7C 

W 



703 



ltt*iftfcVPN8il»J^|=, VPN 



704 



VPN»{::^I — T^i^^'T—z^fi^ I /I / 



[Drawing 15] 
B15 



801 

1 ' 802 



w 

[ ' ao3 

««/^y!yh«)VPNSMiJ^F«lS V 



804 



I * eo5 

V 

I 806 



I eo7 



[Drawing 3] 



http://www4,ipdLinpit.gojp/cgi"-bin/tran_web_cgi_eiie 



JP,2001-345864,A [DRAWINGS] 



3/7 ^— 



VPNA 



12 9 



-22 



ISP 

1.7 



LANS 



•13 



23 



!1E:IIA 



1 1 































LAN4 Sifc^B 



21 



[Drawing 4] 



55-1 

65-2 — ^ 
5M 



k1 y<| ►-Jt^u^^ 



55^ 

56-3 X- 



57 



so 



52 



I 



mm 



52 









^ 




4^ 





[Drawing 5] 



http://www4,ipdLinpitgojp/cgi-bin/tran_web_cgi_ejje 



2007/07/04 



JP,2001-345864,A [DRAWINGS] 



52 



B5 



ICO 



101 



103 

















► 


IF 



102 



vpNuaij- 










vpisiaww 









IF 



um 



■150 



■152 



no 

















IF 



106 



105 



104 



[Drawing 6] 



aoo Z03 202 201 204 
\a \a \ \a \ 


#^ 






1 


ATM 


^ VPI. VCI 


cLp 


2 


ATM 


VPI, VCI 


CLP 


3 


ATM 




CLP 


4 


PR 


DLCI 


4 


PPP 











[Drawing 7 ] 



http://www4.ipdLinpitgojp/cgi-bin/tran„web„cgLeije 



JP,2001-345864.A [DRAWINGS] 



202 



201 



137 



Z04 



250 



2S1 





\/\ VPN« \/\ 


' VR, VCI 


CLP \ 






a 


O 


VPNA 




61 


1 


VPNA 


b 


b 


o 


VPN6 




b 


1 


VPNB 


d 
















^ ^ ^ 

252 201 (b) 

1 \^ \ \ 


ly vPNi«»j? 


\/\ VPN«^ \/\ 








3 


VPNA 


a 














n 


VPNB 


b 














M »h4 




[Drawing 10] 



http://www4.ipdl.inpit.gojp/cgi-bin/tran_web_cgi_eije 



JP.2001-345864.A [DRAWINGS] 



no 



450 




462 453 



451 



400 

Amm 



407 

tL- 

455 



456 









I" 


VPI,VCI 









VPl.VCI 


VPN 




VPNA 


b 


VPNB 



457 



'if 



VPNBffl 
^458 



[Drawing 11] 



111 



401 




461 



407 



455 



VPNIftai]^ 






r 









T— 




VPN 






1 


VPNA 


2 


VPNB 



/x/457 



VPN Afii 



VPNBffl 

^ 



458 



[Drawing 12 ] 



11112 




5 


^2 


vpNiftaij 




DLCI 


VPN 


1 0 


VPNA 


2 0 


VPNB 










VPN 










2 




3 





457 



V PN Affl 



VPNBffi 



VPNCffl 



505 



VPNDffi 



[Drawing 13] 



http://www4.ipdLinpit.gojp/cgi-bin/tran_web_cgi_ejje 



JP.2001-345864.A [DRAWINGS] 



7/7 ^—iy 



013 




6p2 



5p2 



455 









VPN 






1 


vpiyci 














604 



6pl 





VPI.VCI 1 VPN 






b 





457 
VPN AJfl 



VPNiiSlJ 




VPN 


2 




3 


SOT 



458 
VPIMBJH 

VPNC^ 
VPNDS 



[Translation done.] 



http://www4,ipdLinpitgojp/cgi-bin/tran^web_cgi_ejje 



2007/07/04 



(19)B*H#fFrt* (JP) 



(12) ^ ^ It ^ g[ (A) 



#9B2001 -345864 
(P2001-345864A) 
(43)^» 0 ^J^13^12^ 14B (2001. 12. 14) 



(BDlntCl.^ 
H0 4L 12/66 

12/46 
12/28 
12/56 



F I 

H04L 



11/20 
11/00 
11/20 



B 5K030 
3I0C 5K033 

G 

1 0 2D 



aSEa* »«««Dft23 OL (^18M) 





»M2000-170414(P2000-170414) 




000005108 










(22)mHB 


^m2¥6n 2 B (2000. 6. 2) 




































«St* «- 
























10007S09G 








ma 











(54) B8M©«ail n^ryh<E3|$i[«:3&j*Ra!VPNlKWflW|{DK^j* 



(57) C^] 

[R®] m— |Hl^li:«^(DVPN (Virtual Private 
Network) C<omWi^lU^ir^X. 
•y v*;l/— ^c:fe^,''T^ SMLlTc/^-i'- -y V tmtl<0 VPN 

aw*^-v ^-yi/ft^^Mt/^T VPN ^IBgij-r § c ii'^T 



S2 



B5 



100 


101 


103 

Vv 


















11^ 



IF 



-151 



















IF 



106 



10B 



±fB«^€'VPN{i:tij!9ST?,nTV-'SVPNSi: 

mm^oy V p N <o -5 -^MtKo VPN fcMf s *^«WBfr 

±faiilSO V P N©# V P NMiStC. #V P NT^Sffl* 

s. 

Cli*« 5 ] 1 7!/lilf 4 <D^n*HC|B«©;l' 

±fB^ff|Hl»±. ^^HWKM^-K (ATM) [Ulg-efe 
t). ifairaa^-V*;!/!^]?^*^ VP IS.tfVC 
5 c i: -r 5;i'-^?««o 
[Wsf^Jg 6 ] W*^ 1 75Mil*« 4 co^Bfn3b^fcS«©;V 

'f-^^i^m&H'^t^ D L C I T^sc i:«ri»«tfr«;l/ 



(2) 00 1-3 45 864 



±fB»ffi|lIiSfta> L 2 T P (Layer2 Tunneling Protoco 
1) T^S^tlTVS L 2 T P'\'y:rT?5!7:/-fe;lxft:*n 

T^r^^yYtFrnm-^^. ±faiia9^-¥^-.;i'iigij^as l 

Cit*3S 8 3 1 Timkim 4 
B. 

CW*«9] ii*:«17!)Sli*:®4 0Mn*Hc|a^<07l/ 
iiaS^tlHli^as PPP Over Ethernet 

20 ci»*]g 1 o ] m^m 1 7!;sii*3g 9 ©Mn*Haa«5<o 

±lBMWS^*>e.. iiaf^-y^l'rtlc^KfSti^ifa^ 

T. rvPNj ^:^^■5„ ) fcM-rSH l on— j!;;^ • x 
30 yr-^-yh'7-i' aXT TLANJ hx^^bo ) KtfH 
2 <D V P Nl£:M'r5l|2 © L AN*^^|BI— ©:/n h n;!/ 
T * y-t:;Hk ^ tifc/ -V Y nrMM^ tiS HI 

±fB^ 1 ^mmti^ib^i'mx^t^j^^ y h *^±faii i © v p 
N ic«-r 5<D*\ ±ffi^ 2 © v p mnrnt^ofs^^m^i 

m^mi 2] m^mi H^iB«©;i/-^aiB-efet> 

40 ±iB:/o h n7l/l±5^llIfflfeMt- FrT'a F n;l/Tfe t) , 

iia^sm* V p I jstxfv c i t^^i^-r-g. 

^ti^tL. • 7''7'i'^— F • F"? 

(WT> rvPNj tv^do ) fcM-rs^t^On- 
• xyr • ^-y F'7-^ (JJ^TTLANj tV^ 
•5o ) ©:/ciFn;l/T'A>^-fe;Wt;«n?c:>''?-^>y 
F 1 <DlHB«^lKS-rsm 1 O-^' >':5? 7 X 



(3) 



±mm 2 ©iigij^ i±±fB^ 1 «D^ij-? t nm^^ ct:^ io 

±fe^ 1 OMJS'miV P I RXfVC I T-fet). 
2ComS'miD L C I t?feS<l i:;gr#^St-r-5-'l'-^rS 

m^mi 5] ;v-^f^HT'SoT. 

rvPNj tr^^^o ) fcM-rsH 1 on— Tt;;!/ . X 

• ^-y VV—'? (JJ(T TL ANj i;i/^'5, ) ts^^% 

VPNU:M-r5lg2©L AN*^e> ±13111 CO :/'a hn;!/ 

H 3 © V P N IcS-r 3 <D L A N e,|g 2 « :/a h 3 
m4€)VPNlcM-r5B4£DL AN3b->e,±fB^2© 

3<ommt^i^^T^m2o^-^i/$ty 

±mm 1 (OEii^Tb^ s.S'fi vTc-'^'y -y h ti^±mm 1 o v p 
N (cM-r 5 cD*^. ±iB^ 2 o V p N (c«-r s o*^*i8Sij 

h*^±feil30VPNfcM-r5©*\ ±f3ll4<DVPN 

±feii 2 ©a^gij^ a±ffi^ 1 ©i^gij^ t aa^s c t * 40 

±1211 1 O h F P^a h n;l/T^ 

±Emi©iRS'm4VP IStfVC IT*»ti. 

±fe^2©7'D hn;WiPP P over SONETtffe 

±fes2<D«isim±. ±ieii3©iiii^i:±fH^4<D 



#ffi2 0 0 1-345 864 



OUT. rvPNj i:t,->^o ) *iR^*rsct 

^■ST^ s 71/- ^rSBic43t5- ^.^ >y h m^mm:^mT$> 

±fHMi5:OVPNfcfiJt)STe.tlTI^-'SVPN« 
±fBSM/^^ -y V iji±mW.WL<D V P N© -^{SftlO V P 

±.m^mmst\t. #pig«Kj^t-K (atm) @«»t* 

D . ±f3^ffi^-v^;viigrj^«, V p I m^v c 1 -eas 

h -^--^/hv-^ (j^T. rvPNj ^^^•5o ) icmt 
^mm.<On~ioJ\y J^VT • ^•yhy—i' (LAN) * 

i\mts,j\^-^mmic^i'f^ v p N«sijf»«j©^;^^ 
±fB;v- ^mma. ±iB«iSt<D l a n o— sis© l a n 

mU ±E«ifc©L AN©ffi©L AN*^C,ti||2©P'n 
±IB— gPO L ANiJ^l^^mi.rc/^^y h ib^Mn© V P N 

icm'r^(Di)^^mi'r^tcib(om 1 ©i«S!i?*±ep<* 

±.mm<0 L A N*^?.ft# Lfc/^^ h jb^fBfti© V P N IC 

M-r 5 ©*^*iigtj'r sfcJixDM 2 ©iigtj?;fe±E^ * u 
±fBii 2 ©^gij? t±±Eii 1 ©iisij^^ t nm^ ^ct^ 
imi^m. 2 0 ] rn^rn. 1 9 Kmm<o v p NiKsuft^cDg 

±fBmi ©iJS'J^i:. VPNfc|iJ!?aT?.tXTV^SVP 
±iBll2©iigfJ?i:. VPN{cSiJt)ST?.nTl^5VP 

im^m2 1 ] 9XaW*^2 ooMm^lcfB 

«o V p NfKgiJ1f$gcDi5^;^r?*-efe o T. 
±fBII 1 h ajVmmm^M'e- F^n F 

0 s ±iBm 1 (Om^mii V P I Sitf V C I T'^S t) > 



W ^ 2 ffl S -r § y n h n ;Hc cfc ^ :^ y -Ir 

YV-^ axT^ rvPNj ^V^-^o ) ^IRS^^;1/- 

2 tcffi^-r § T'n h j; ;5 ;^ ^^if 
W^^tifc I pj\^y V^^\wt^4-y^y 

t^m^^ct^^mt^^?]y-^mmo 20 

[0 00 1] 

mm^^jmi^m^. mc^i^^-^y hicmf^mm 

mm (VPN : Virtual Private Network) ^mMT^ 

So 

[0 0 0 2] 

(Je^T^ VPN : Virtual Private Ne 
^fco COiJ^Sli. I P (Internet Protocol) h 40 

u-^tmrnr^ I pfc§«/H* I poTffii^^-\'o«stg 

[0 0 0 3] VFN^miMt^1j^ti.ri±. VPN^ 
\,\ I SF(0:^>^y hU—^±X}^tC<0:^y^Mti.rc^ so 



#gi2 00 1-345 864 



hcD[^gg-etiVPN@#0:^7'^;Wt;^^y^^^ 
^m\i^^ri}L\c^X>. -tr^^o-UT^^OSm^nfcVPN 

P ha;l/^LTti:. I P:^y^;Ht. MPOA (Multi 
Protocol OverATM) ^ MP L S (Multi Protocol Label 

Switching) l?07^S?b^^^ D ^ 2 00 0^5H3KffiN IE 

[0 0 0 4] 

[fgB^;b^PS*bJ;d^-rs^«] IPrFU-X^cti:. 9 
n-/svi/l PTKUX^. T'^'f^-b I PrFl^X^i 
Tb^^^o ^^^n-/WI PTFl^Xti-H^65Jc— lclc^a6 

?>tisfefDi?fescDjcMb. rz-^-r^— h I pr Fi^x 

^T^tis y^^-r^-h I Pr KlxX7b'?fflt/^5>n^:l'&7b'? 
^(/^ \.tz,ff^r>X. ^%f!^NF^^-\£.7.m\\mt^^ 
^\z.^\i-^X^^ I PT'FU'XJgrffiMT^S 

cl^?5)^^M*H/>o CO^a-s «^OVPNP^T|WI— CD I 
PTFl/X7b^ffi^^nSprtg1t7[)'5feSo Mm^OVPNM 

I PTFi^x?bv^*y7^>r ^n^*n«ov 

PNcD^^^^y h%iEL<MS'r§/ca6. ISP:^>.^yFy 
-^fOA!:)PtcfiML^ j?)^'::>^ VPNtcM^-^LAN 

(Local Area Network) ^IRS^^S;!^— ^ (iXT^ VP 
NX^y ^^Pf^) ti. VPN»tD;l/— 7"-Y>'^*7^ 

— >^;l'^ffi^'r^ie:^S:6^^^o VPNx>yi/Vl/— ^t^:. 
/^^^y h^Slf-r^^. ^O/^y^y ^;^)^^^DVPN^cS 
'TSLAN^b^e.CD/'^^^y F:^^^WS'rSo ^<om.. VP 
Nx^y>?;l/-^ti. SSVPNffl(D;V— 7"^^^^*7"->^ 
;l/^<t^LT I ^Fn^-jYV-^X(0^&.9t<m:'&. 
^<l:tf:^7y^;Ht:«rfT^o VPNx^y>?;W^ri±vPN 
T^.f^/^^^— :/;V;&fS^bT(/^^0'r\ VPN 
x^yv>Vl/-^ti. Si^§VPN;6^^§ff L/cIrI— 

I P7'FUX^^it::>A^^y h^iilll^r. iEL<S3it- 

[0 0 0 5] MtHVPN^Hga-r^T^S^bTti. 
if rg^n^jix^— >3 ^'j , 1 9 9 9^10^18 

B^s p. 10 0. tcfH«^nTv^§J;'5Jc. rL-ifm 

^^>^-*7a:-X-¥ffitC. VPN^— IctCiiSrJt-^fc: 
i6tOVPN- I D^&WD^Ts CCOVPN- I D^C<J;D 
VPN^gmT-^^i^b^feSo -r^^t)*^. VPNtOligfJ 

Jl-g-^ *^S^>:^->^x-X— OtJ^WPN— OtcMjSL 

[0 0 0 6] L3b^bMfHtO:&STHi. ife||:^^yhy-^ 

^^tSt^OVPN^glM^^fcV^*^. ^(DVPNOScfc 

i^mm^wtmm.^^^mfi'^'^^o vpNx^y 

v>>-^i±. itSi^t^'S VPNO^/ctt^S^V^?— 7a: 



(5) 



#li 2001-345864 



[0 0 0 7] ±m^-y vu-^ti'^y pn'^—y£:^mi 

r> I S P:?^^y hy— ^$T?or^^X#@^UT. Wl(0 

I s p^§vHi:^^^yT;b^ii«'r^ATMai'^7i^-"A 
• yl/-^^^ffll^^il'&^ I s poADp-eii 

[0 0 0 8] *?§0^<Dgm. ^S'Y>'^?->^:3:-XtC 
^«{l:^nTl/^^^S«:S:^i':^;l'#-^^fflV^T V P N 

[0 0 0 9] ^fc. *^0JtOffltOB65t±. ^jb^^LA 
N^lK^-r^^. I PfOT-eW-Vt LTttiSc^Dg:^^ 

-9 c ^ j^pTtgtc -r § c ^ -es So 

[0 0 10] 20 

260^'V:?^;l'#-^:&fflV^TVPN;&Ugrj'rSo 11369* 
^^^^;l/S^^LT. I P(DTffiW^<0'[f$g. Mx. 

VP K V C I ^(D^^y^'m^^. TiiLly^'VtfyU— 
V ]y-(0^\^± D L C I ^mW^^^f-^ b so 

(Layer2 Tunneling Protocol) "^^i^^nTV^^ L 2 
T P^^y^^'Xtf^-^Mt^nXh^^m-^^^^t, L 2 T P 

So Tffil^-^'^:6'?-f-'9--:^^y IEEE802. IQTMS 

;^nSVL AN Ta g :^ffll/^T V P NcO^gfmf ^tl 
S^a-. SufBmS65*^-V^;l/#-^tLTVLANT a 

g^ffl(/^SC^;O^T^So IP>^*^^^y h;^?'?PPP Over Ether 

net;^ y^-^Mt-fS^XM^^^Xi^--^ y^;l/1t$8T^;^ 4o 

y^Mb^tlTV^Sa-^^Cfri. PPP Over Ethernet:^:/ 

So 

[00 11] ^e>tc. VPNx^yi;?;l/-^?Jc. VPNl? 

sutcmi/^siigu?^^^t*sfca6o V p N^gfffK^T^ 

—y^)l^^W^f^o cl(7)S^^VPNx^y>>Vl/-:^;&^S 
-rsi SPOg^«:6^fT^SJ;'9Jc*rsfca6. VPNx 

^y>^;V— y^Vv^— :7x-Xi&K^tSo I P(0 



So s/c. vpNiisa^&vp I. vc i-etT'^iW&tc 
tufH V p Ni8sa?S^'r-:^;i/^c v P K V CI ^ 

K^-rso 

[0 0 12] vpNmwi'i^mmy^-:fj\y(DmmmM±. 

'^'^ bri5|-^D:/n h n;W<Kffl^ns«S<0[lB^«:iK 

§^S'0^-:7a:-X:^-K*^S-et>J;v^o ^iTc. 1 

^(Dmm^^y^-yj^-xmcT&u-^^ti.xmmo 

:/a h nrv^Sil^ (M^Jf:7 WAV 

l^-^PPP:0^B$^>f!j^m^nTV>S[Hl5g|) ti:. ^^OK 

h n;l/t(Dffi-&t3'^T^fe<fcV>o 
[0 0 13] I S P:6WPN^lR^'rs^s I PtOTffi 
W'V^cATMJ&m^.X VPNiKSrj^^LTVP K V 
C I ^Sl-^S»^>^MtC V P Nx^y v^Vlz-^f Ol&f^^* 
^WtciJiBJ-rSo VPNX^yS;?;l/-^?t±/1>5r^y 
^S^. S-r. VPN|gSrj-?K^-7^-:/;VOK^Jct¥ 
l\ V P NiigfJ? (^MiOi^-^. V P K V C I 
^nri/^S) 43J;t>*Sl^r--<^VPNaiESa-r— 
^-rSo VPNx^y>>VV-:$?ti. VPK 

VC I tYPNt<DMJt^ff^m^nx\^^:^'r-y';]y^m^ 
'T^C.tlc-^^o VPNX^ye;?;!/— ^ti. VPK VC 

I ^mm^-ic LT V p Nmm'f—y^;v<Dmm^fT\^\ 
^mi.rc/^^y hfj'iEcDv PNicmi^xi^^^f'^m^^ 

So ^OW^7b^^Tt-S^. VPNX^yS/Vl/-^?t±, ^ 
MLfc/^^^y h3b^S^SVPNffl«75;V-7"^ v^^^-r-rf 
)l^^^m I s P ^y b y-^ f^<7:)^^o^3M^fe^S^^ 

u hy-^p^xv PNmn<orcibicmm-^n^^ 

-if^Mt^ y ^Vm<o^mT V P N X -J TV— ^? 

/^^^y hte:-N^y^'[f^;&{>f#U ^bfc:^C>lteiM 
5fe-N/-^^^y h^^JMa^So 

[0 0 14] JW±o®i0j(Oc};dtc> mm^ 
>^?-:7x-Xtc^Sft^tiTV^SI&SSg*^'V:^^;V» 
^^fflV^TVPNfiSfmT'9fci6. VPNx^y$;;W^ 

V p NStc^^a-Y^'^f-y oi-x^&mTSigvS*^* 

M^'^^fci.-^:^'^. ^(Dvpn(Dm'mmmmrs.=f'^^^)\y 

-rsig^Mi^m^o ^/-c. ifen^^y ^y-^7b>e>vPN•9- 
--ex^^f'9 I s pj?^>y hy-^^^^or^^x^®^ 

bT. gycil S PfeSVH^:^^-vUT:b^a«t- SATMffl 

•^yi^-A- y u-#%S(.^s»'&tc:fei/^T^>. wmm 

^^-v V P N^SWff t)ns:rca6. V P NJ&*i@ 

'rs<i^;^^-e^So 

[0 0 15] $?,tc, *%0Jtc<J;ntf. I s poga# 
ti. I P^OTffiWi'oynbn^l/fttcvPNiSga^* 

ii#ib. ^<?DVPNiigrj^^VPNi^gy^^^-^-y^;V 
tcK^t*SCi:;6^'t?^S/c46. VPN^ltXS*rS^. T 



(6) 
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[0 0 16] 

[0 0 17] IS P^^y hV—^ (5) ti. :t-^y h7-~ io 
^tO/^C/iy^^Uicfi^M-r^x^yi^;!/— ^5? (9. 10) 

^.^y Fy-^nr^cf4B'r^r3r;W^ (17) ^ 
^W^'So SlT^ti^ aT)V—^ (1 7) oL;b^^ 

l/^o ISP^^yh^-^ (5) rt§P7?ti:MPLS (AT 

icm^n^\^\ I sp^yh'y—^ (5) It. x^yz^jiy 

(9) ^-ftVXLANl (1) tLANZ (2) ^ 
iK^U x^y$/;l/-^ (10) ^/rUTLANS (3) 20 
i:LAN4 (4) ^riRg-rSo LANl (1) ^LAN 

3 (3) ifeHAfOL AN*t?*t). 2:tl?>fOLAN 
P^TVPN^«^r§o S/c. LAN2 (2) ^LAN 

4 (4) tin— ife^BOL ANT^D. <ltie)OLAN 
P^T^t^VPN^^^^^c ifeHA. ^^^B^DVPN:^^ 
n-?nVPNA (7) . VPNB (8) tl^SCtlCf 

[0 O i 8] L AN 1 L AN 2fr±. ISP^^^^yb^— 

^ (5) ^tigrjfO I S P^fct^4^'VyT:^^^^«'r^AT 

Mgg (6) msi (1 1) tcii^esic^sit^n 30 

Xx,yzyj]y-^ (9) tcSl^^nri/^So lUiBI (1 1) 

(9) (D^m-{ty^-y:Ju—7.^ (1 

2) ^-r^o ^m-fiy^y:sL—xti^t. jv—s^tmmt 

(OmmMtl^^^MmX^^o LAN 3 (3) 

AN 4 (4) t±^tl^^nRFC2 6 1 S^^^^tlTV^ 
^POS (PPP Over SONET) Ultt (13). 

(1 4) ^^n-LTx^yi;;!/-^ (1 0) KmU^tlXl,^ 

iHisi (1 3) . (14) tJ^y^jv--^<omm'^zy 
^-y (is), (i 6) h^^o 

[0 0 1 9] ^SIMMTHi. L AN 1 AN2;^^Mb 4o 
Tl/^SVPN^ifgrJt-^iSgU^^LTVP K YClff^ 
mi^^^ti^o :r.yi>^JV-^ (9) rttc^^t^nfc V P N 

(12) JcJ^iST^XVhU^Cti. VPU vci^s 
^^n^o x^ye;?;!/-^? (10) LAN3^LAN 

4 ffm LTv^^ VPN ^iisu-r ^ vxmm^ v 
-3? (10) mcmiffi^nrcwpNmwB'mM'r-y)v 

JC:fel^T. %ll-r^^^-:7:ii— X (15). (1 6) 

MJS-r^x^hyicti. ^s^v^^y-yji-Xi:^^ so 
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tiSc vpNm^'^m&'T-y'Mmm^ti^o 

[0 0 2 0] Sfc. X^y>>>— ^ (9) P^tC^i. VPN 
i^gfj?^. ^KVPNi«Sy?:&#'r^/^'ir^y h:6^MnC) 
VPNtcMf ^STb^J&^-rff^ (fi(Ts VPN#-^tl.^ 
•9 0 ) ^0?!fjSII^^^'rVPNilSrj-7^-y^;l/:b^Ktt^ 
tlTV^^c ±tBVPNA. VPNB;?)WPN»^tcK^ 
x>ye^;l/-^? (9) rttcti. Pr 

mmtcom%^^T)]y-y^^:y^''r-':fMm^f^nX 
l^^^o C(D;ly-y^^y^ifv—':/MtVPNAm(0^<D 
VPNBm(Dt><Dtf)mM^tl^o VPNI^SUt^- 
r ^ :y^'y^-:/Mc'^i^X^^^^'^n^o 
[0 0 2 1] X^yi/Vb-^? (9) L AN 1 3i)^e,iMfS 
^nfcLAN3%OI P/^>>-*y h^SM-rS^. VPN 

mm'?m^'r-y'?\yo:>mm^m\^\ v p Nijga^^ lt 

VPK VC I :^fflV>^cli:^?^^t-^o VPNiiSa^ 
>&?5^^bfc^. J^y-JjV-^ (9) ti. VPK VC I 

V P N tcOM^^ff^tEtlXlf^^ V P Ni^grj-r— 
^^b. aK>'^^^y h:6WPNAtcM^^>'^^^y bTfe 
§2::fU^^^o ^^tc. x^yi;>>-^ (9) ti. P 
r K UX:^m^^—t LT V P N Affl(0;l/-7"^ 
-:/;l/^^^b. :^^SM5fe^onr;l/-:^ (17) ^J*^ 
^bT. nT;l/— i^fT^^OVPNAlcM'T^^/'^^^y 

M^^tifc/^^^y htis nr;!/-:^ (1 7) ^^^teSt^ti 

[0 0 2 2] r3r;l/-i^ (1 7) ti:. :^y-lr;l/^^y ^\ 

'r:ftt5'^. VPK vci 

V^^7"-:/;l/^#bT43!9. S1t>'^^^yh 
O:^ y^;l/^^y ^^^^^^^^^^-tc bT:^KM5fe (x>y 

(1 0) ) . 43cfctf:^(D:j?7y^7l/--s^yi$fj£:g^b. 
tufH:^y^7l/^*y^^*#^bTx*y-:;^;l/— (1 0) -\ 

[00 2 3] :s:iyz^)V—^ (1 0) ti:. x-7>?;l/— ^ 
(9) x^ys>>--^ (9) ^|rI« 

tcbT. ^«/^^^y hO;^y>fe;l/^^y^^^^^4^-tcb 

rvPNiigfmfv\ vpNAtcM*r^/^^^y hT^^ 

r V P N Affl07l/-~7"^ ^'^^T^-^^VV^^^bTfeiM^fe 
^?^b. ;^y^;l/-N^y^^^^t±-rbTL AN3-v^^^y 

[0 0 2 4] X^yv^Vl/-^ (9) It. %m^1/^ — y :sl 

-Xtc^M^n/c!illfi5^^'¥:?^;V#^lc j; V P N;^ 
iSgabs ^KVPNfD;i/-7^^>'^^^7"-:/;l/;^^^T^ 
(0T% -o<Dllfi^ti:^ll95tc:^M^nfc VPN ^^grjt" 

^5 I PrFl^X^^ifellBjbm^^ I Pr Fb'X^^^V^ 
[00 2 5] VPNBrtOL AN4jb^e>LAN2-\/^^ 
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I P/^^^y h^S«LfcX>ye>Vl/-i^ (1 0) Ict^ VP 

mmr^Tcibomv^^o ^mmmvit. l an 1 1 l 
AN2t^. wmm (1 8) . (1 9) ^/^LT. mm. 

I S F^^yhU—^ (5) ^(D^m{tmm (2 0) tClK 

^^ti^o ^mitmm (20 tc^oi^r. vpna. v 10 
(9) ti. m\(o^}Lnmi^. vpk 

V C I >&fflV^T V P NlKgrmT ^ o 
[0027] 03 tJ:. 01 JC:^^nS^MC>ffi<O^Jg 

[OO28]03Tti:. 0Uc^bfc*^y hy-^«^ 
te:. LAN5 (2 1) ;bHir^tAa^e>nT:feD. LAN 
2. LAN4StfLAN5(OfflTVPNB7b^«^^tlT 

t/^^o LANS (2 1) ti:POS^flil/\ (2 2) 

T3i^y$^;i/-i^ (9) tcg^M^nri^^o mM (22) 20 

^X^yi^;!/— ^?<3DiaS^>^t$f— :7j:-X;^ (2 3) tl" 

[0 0 2 9] X>y>>>-^ (9) ti. 13 1 OSiB^^H^ 
tc. LAN 1 ^LAN2:b^MLTl/^SVPN«:»ga^^ 
IJgrj^^LTVP K VC I >grffll/^;g.o — x.^yi^;l/ 
(9) ti. L AN5?b'«SLTl/^^VPN^iiSa'r^ 

(9) rt^DVPNlEgiJ^SS-r-^^/l/tCti:. trS-^ 

X (2 3) tc?>fjS'r^:ni:vhUtcM-i'> 
^?->^ji-X^^^^n§o ^USSM-eti^ JC^y^;^;!/- 30 
^ (9) l^tc, VP K VC I ^VPN^tD^*jS:ib^^^ 

nTi/^^vPNiigrj7^-:/;v^, v^-:7^-x 
V p N ^ <3DM;s?b^^^nr V p \^mm^—^)\^}t 
o2aiig(ovPNiKga7"-:/;i'*^^tte.nTi^§o 

[0 0 3 0]M^tf. L AN5;6^^Mm^tl/cL AN4 
^(r>\'?7\^vV^^m\.fc'^^. X^yi/Vl/-^ (9) 
li. VPN|«grj?^7"-:/;l/£D^tcfif(/\ VPNii 
gfj^^bT%s^>'^-:7;c-xtos^^ffli-^;5cii:^ 

l5^^t-^o VPNifgfJ?;&i5^^Lfcf^. X^y>>>-^? 40 

v^;5VPNiiga7"-:/;i/:&^^u ^ioi p>'^^^y hi^^^^ 

VPNBtcMt-^/^^^y h-e&^c^^&W^'r^o 

tc. ^5fel PTFlxX«r|^^4^-^bTVPNBflBtD;l/ 

(1 7) ^i5^U ^cOi5^Lfc:n7';l/-^?tcMII^n 
ho::?7y-fe;l/^^yi^%?^t*^o ci^D:???:/^;!/ 
-\^y:^^^/^>^^y htc##U (1 7) tcfeSM 

^•So 50 



12 

[00 3 1] **Sfi0!I-??ti^ M^STte^P hr3;VSJc 

VPNiiga?;&Si6. ^VPNiSgfJ^^jSicVPNi^grj 

^c^R^bJ;•5^^§Tfi[y^^r3;l/^ci^:^DT. VP NIK 
ga^ig:^7^->^;vp«g«DVPNiigfj^^K^U ^cdvp 
NiiSU? tcMiS-r^ V P N|gegfJ-r-y^;V;^S^L^^f 

[0 0 3 2] *^^OVPNJ:^y>?;l/— :$?coi¥Jffl 

•^mmt^o vpN^«^^^_tT\ ^^-j'w—^(r>m 
§ m^(D V p N X ^y >?;w ^ (Dmmcm^LxMm^ ^ 

loo 3 31 m^ib^^ms^mi^^r. VPNx>y>?;l/- 
^ (9) sS^M^SiB^^^o VPNx^ye;^;!/-^? 

(1 0) (Dmjs.^ctitmm'v^^o 

[0 0 3 4] m4ltt. *^8^<0VPNx*yi;;l/— i$r 

(9) (D-mmm^^Tm^^^o mm^ (5 0) t*. 
Tfei^-Ti-i^iagp (5 3. 5 4). ^^^yhu^^mm 

gP (5 2) SrfX-f ^y^ (5 1) ^g|M^tlT43t)> V 
p Nx^y iyjV—^'^i^(DmmRlf)\y—'r^ :y^Mm^E 
^fT-^o TfiU-r-VMSgP (5 3. 5 4) mWi (5 
5. 5 6) ^^iR^-r^^^fetCs I PfDT^uW^O*? 
m^n^o ^^^^yhly^^mmm (5 2) ti. TffiW 
i^'&Sgp (5 3. 5 4) fo^^TiiLU^^ommRrj I P 

^^^o X^>y^ (5 1) l±mWL(DXmt]^^-h^mL 

M^nrv-^-So X^^y^ (5 1) ti:. ^aX>'^ 
X^^y^-e«^^n^o X^^yf^ (5 1) ^^^yh 
U^^^m^ (5 2) t^^^i^y h^^im^^t. 

yhu^^mm^ (5 2) \c^\,^ri^m^tirc/^^yh 
t-^o wfes«j®gp (5 0) ^ctisiM^s* (5 7) ffmm 
^ rtcD V p N^gfj^^-r-:/;!/. V p NMga7"-:/;i/ 

S^o ^ff|llS5 5~ K 5 5-2. 5 5-3JiT^55 
-4^;!/-:$? (9) ^ti^^ti. t^S-Y 

>':^:7a:-X#^ K 2. 3ST>* 4 :^)'5fiJ t) ST e>tlTV^ 

[0 0 3 53 ^5 a. z^'^-;' hb-Y-VMaglS (5 2) «D 

— M^M^^^-rsT^Sc Tfiti'^'-v^asp I F ( 1 0 

0. 1 0 6) . X-r^y^ I F (1 0 3. 1 0 4) RUM 
»a5I F (1 10) ^tl^'tlv TfuW-V^!Mg|5 
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(5 3. 5 4) ^(D-rv^y^x-X. X^^y^ (5 1) 
^£D-f>^:7ai-XStf$fi»a5 (5 0) }l(O^Zy^y:r. 

(15 0). VPNiggrj-r-:/;l/ (15 1) 

StfVPNffltO;!/— (15 2) 

m^'i^(0^^^tr^\^^o VPNiSSO^^^'r-^^Vl/ (1 5 
o) . vPN^ga-r->^;i/ (15 1). T^^v^^T^ 

(15 2) Rr;^2:T^Si0^L^:?)^ofc^i7Dftfi(D>^^ 

a^y^(0«itg-^m^ £(T-eSi0.i*r§;i/-^? (9) (O 

CO 0 3 6] TfSW-VMSgP (5 3) tmmi.X\^-^^ 

mm, (5 5) tt^tb^^^vv^mmi.. -ritLiy^^mmi^ 
(5 4) tmrni^xx^-^^mWi (5 e) -^i>>->y h^^si 

Co 0 3 7] Tfub-r^MagP (5 3) LAN7b^e> 

^«i^t-^o -r^iy^^mm^ (5 3) t^. i p/^^^y 

»^ (JKT. ^MtrS>f V^->^:ii-X#^^J¥^) . 
T^ul^^^o:/nhr:r;l/fflSfis V P Nf^Sa^^ LT^^ 
^TfuLx^^C>;^7'>{r;l/^^y ^^1#S#;gr>^"^'ir^y h 
^5{Lag|5 (5 2) -xfeiM-r^o 
CO 0 3 8] h (5 2) rtOTffil- 

-f-VMagp-r>'^?-:7x-x (100) TfuWir 
mmu (5 3) :^j^e>teM^n/c i p/^-jr^y 

XSV P Niigrj^^ LTMV^^T1ul^-r'^0:^:/-tr;l/-N^y 

:$^W?g^^^^^y hteMMsgp (10 1) -xtei^-r^o 

^>y hte3li«LSgP (10 1) ti. ^mb;rc I P/^>>-^y h 
I P^>y:$^^fff|g^fflmb. ^(D I P^^y^^'fff$S. § 
MM'Y^/^-:7x-XS^. Tful^'Y-VOT'a 
aSUStf V P NlSSy?^ LTffll.^§Tffil^^^O:^:/^ 

(10 2) -x^Stf I Pz-^^^y Y^mt7^^ 

-J hemagp (10 1) n\^-^mmm^t\,^o 

Co 0 3 9 ] VP NIKSfJ • ^y^^-^jV^^^ 

ssp (1 0 2) s-r^fiw-f ^/^-:7;c-x# 
PNiisrj?^-r-:7Vi/ (15 0) ^^^b. vPNii 

CO 0 4 0] S6ti. VPNiiSU^S^7"->^Vl/ (1 5 

0) (0-mmm:7r<to #x>hyt±. M-f>':^-:7 
rc-X*^ (2 0 0) . TffiW^T'nhr!;!/ (2 0 
3) StfVPNiiSrj^ (2 0 1) ^^WT^So Tful^^ 



(9) <D^a#ti. (5 7) VPNiiSU 

7^-:/;i/«^®fSgP (10 2) 

iJH-f >^^?-yj:-X#^^&ffl(/->T^^^tf(/\ VPN 

iigrj? (201) ^m^^^o ^mmm^i^^ 
y^L-xm^tiUom^^ vpNiigfj^^ivp K vc 

<D^^\c, CLPy^-ji^y^^^m^f^m^icit. VPN 

mm'ft LT. VPK VCItCLP ^^Offi^^t^ 

mm-f>'^y :c-7.m^tc LP tom^^t)'^^ 

fflV^TfecfcV^ VPNiigfmcCLP (2 0 4) 

^:7x-X^C?>fLT. MmfOVPNtcMt-^/^-^r^y 

a:— X»^:6^6»li. ^O/^^^y V P NJcS-T^ 

20 A T MO:^^. VPK V C I V P Nf^gU? ic^O^ 
^O/'^^^y h;0^HiOVPNtc||'rsO;b^^iSgrj'r 
^ctff^-pimt^^o —'^(omm-fzy^y:ii-xicnh 
— o(D V p mcmt^^^^y h i.i)^mm-^n^j:i^m 
^icit±. mm^zy^y:yL—xm^xYPN^mmT^c 
tt>^wmxs>^o ^m^-ti.x. T&iy--c^(Dytih 
r3;v(2 0 3) ^trs^v^-:7x~x#^ (2 0 1) 
t(Dm^^t^^^mi^x^^\,\ &\mi. mm^>^- 
:7x-x#^ 4 icmu^n^mm-hm^m^mmmx^ 

30 l-— ^^MV^fcZ-^^^y h P P P (Point to Point 

Protocol) ym h n;l/;&^v^fc:/^^ y h tlTl^ 

-(Dai>'hytc?^LTti. VPN^fJ^-^bTDLC 
I:6^^S^nT*5t). T{uW^7'ahn;l/7j)^pppcD 
Ji^/hUJcJtLTti. VPNffl8grj4^-^LT:^-l'i^Xn 

^y hSW^^^nrv^^^^^o ^^D©^, Sfftra 

VPNa?ga^:^>^DLC ITfeS*^^$f^AXn^y h» 

^X$>^f)''ff-'miC^^i^:^\,\ ^CX\ ^com^ic 

40 ti. sm®s-i'>^:7jQ-x#^^TfiLWirya 

VPNa8gU?^«l^t-§o 
CO 0 4 1] VPNfigU^;^)^J^^n§^. VPNligrj 

"^^^m^- 1 1.x VP NMWl'r-y'jV (15 1) 

CO 0 4 2] 07 (a) . (b) It^ VPNfgegfJx-:/ 

;i/ (1 5 1) (D-mf^m^^sTo E^^(DVPNmm'r 

->^7Hc::fel^Tt>. #x:/hyti, vPNMgy-? (2 0 
1) ^VPN#^ (2 50) t^m^^o 
50 COO 4 3] 12 7 (a) t^. V P NffigfJ^ (2 0 1) ^ 
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UT V P K V C I ^mv^;5-r— :/;KDM^S^bTl/^ 
So m7 (a) (DCLPy^-}V]i (2 0 4) RTfmm 

f^m^mmmy --'i^ f (251) umim < t t.^ 

V^o «®f^flKfeS1f^:7^-;l/K (2 5 1) tlis «« 
T'a& So VP NHsS'J • /I'-x -I- lyif'r-yjvmmiimm 

(10 2) a. «3g^- LTtSfficO V P N»j:?^ 

^: i^x/^-y yh^y ^i^fHo) V p Nms^iwm^m^-^ 
xmmm7^\ vpN#^ (2 5 0) ^m&-r^o *si 10 
mmoii^ic^ vPNiissfj7"-:r;i/ (151) tccLP 
y^~)V}i (2 0 4) SC/^«rt«5feJS1ffS:7^-;bF 

(2 5 1) *^tt§»&{Cti. ^^^-^LXa. /-^^ 
>y FOfi3MflBfe**^f-CLP (2 0 4) fcVP K V 

c I olM^i'-a-tJ-^^ffli/^Tfe c L P^m^^—ic 
-g-ibSCtlcj;!?, Ill— OVPNS^{cS-r§>''^^>)' F 

So CT^tS. *' V P K V C I = a " ti^-D" C L P = 
O" OWr^li. " «ert«5fe*=a" . " VP K VC 

I = a " c L p = 1 " (om^^t. " mmnmbm 20 

[0 0 4 4] m? (b) VPN^giJ^ (2 0 1) t 

Lx^^^y^—y:Ii-xm^ (252) ^fliV'-ST^— 
137 (b) (DSartg^feAft^y^-- 

;i'F (2 5 1) i,tmim<xi>m^\ 

[004 5] ±mKm<OWP NIKSU?. m^t£. D L C 

(a) . (b) ^ll«o-7^-7;v*«^-rti{f -r 30 
ikt>%. VPNiSSijT"-:/;!/ (i 5 i) a. VPNiffig'J 

^mimif-^ti. cti?.<DK^t±. Mfflii^* (5 4) 
e-KS^nso V p Ni^gij^^tc^t^ ^ntcwp Ni^gij 
7^-:/;i/ (15 1) tts |ni-©p{*y±fc«^^tiTt. 

[0 0 4 6] VPN»Wj3^^n§ii. VPNl^giJ- 
filtst^VPNm(D)V—'r^>'^'r~-:f}V (15 2) ^ 

[004 7] H8li. VPNffl;l/— r-O^^-r— 
(15 2) ©— «^M^zi^-r<, V P Nl^iJ • -y 

9y-~Tf\/^mm (10 2) a. hj^-tsvpn^ 

ic2:«DVPNffl;i'— v^^-^^^t"— (i 5 2) ^-K^ 
•rSc e:<DVPN«tc^tt€.n;^cVPNffl;i'-7"^'><>'' 
(15 2) a. iBi-©><*';±(c«f^$nTfe 

V P Nffl/l'— r-i" l/if7—y)\' (15 2) a^5fe I P r so 
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Fi'X (3 0 0) tmtsyj^m^ (sod ^la;^*:/ 

-fe;l'^-y:5^1ffg (3 0 2) t^#-rSo ffi:^J7jK»^ 
(3 0 1) li. X-Y'y^^Tv^^-y ^;&RlfMO'^:/:^^- 
:7J:-X^ci|teSi•rSfc^6©il«(^iig^J?t?fe5o mtsfi 
7'-fc:;l"N>y^f'[tffi (3 0 2) I S P^>y Fy-^ 

(5) nxm^^^^-^-z^ix^^y^msLx^^o yp^m 
m- j\^~7-^i/'tf'T~y)vmm9sm^ (102) a. 

T. tuie© V p nmmv'~f)\'<Di^m\n * d l v 

PN#^ (2 50) Ic^jS-rsVPNffl©;!/— T^-fi/^'' 

y—'/)\/(omm^'^\^^. ai*;5rm#^ (sod stfm 

;f7*7'-fe;KN>y^"1ff^S (3 0 2) ^^^S'T^o **»J 
■??a. VPNfttcvPNffi;!/— T^-i-i/i^x— r?";]/ (1 5 

2) ^-^Ijrv^S^-e. ^Sc©VPNf£::fet,^TIlI— © I 

prFbx^^^gM^nr^^rt,. iEU(.->tB:^j:7jBS*s^^ 

[004 8] m±f75-m»^ (30 1) ttil:^f*7'-b;l"N 
-y^^'lt^ (302) i;*^j*S*n5i;> VPNiSgrj-;!/ 

-7^-1- v^^T^-^^^i/^^Maas (10 2) a. ^<Dj5^^ 
Lfcm:^j:&g& (30 1) hmtstiy't.)v^y^msi (3 

0 2) t^/^-^-'y Ftema^S (10 1) Icft^-rSo 

[0 0 4 9] ^'^^■y FKM^fLSgP (10 1) 14. X-f^y 
F (10 3) ^/TbT, HabTV^fcI Pv-^^^-yF 
di-MS'S^m^ (30 1) Sitfttl*5!j:/-fe;l'^'y:5^ 
tfffi (3 0 2) fc^Xi'-yg^ (5 1) ic^-rs,, X-f 
>y9" (5 1) a. ^-^^^y FteMMagP (10 1) *^€>^ 
Mbfcl P/-^^-y F*#:t. ^(omti:^y^)]y^y^m 
« (3 0 2) fc*. ^(DtH;b75riNl^tcm'rsHl:t;d? 
-Ffc[tl;fj-rSo 
[0 0 5 0] iiam^^^-FtcS'^^tlTV^S/^^-y F 

W'^Ma^ (5 2) . •r**)-^. /^^^yhu^-vmm 

gp (5 2) *^5,M«*tlfc I P/^^>y h^i^Rlf^tcom 
ij:iiy-t}l^'y^mi (3 0 2) ^^MfSMO/^y-y 
FWirSaaSP (5 2) tt. X-r>y^I F (10 4) 
/TLT. ^tl?.*S«-rs<, I P/5^>y F*#:S:t>*^0 
ttltr*::/-tr;l/-N>y:J^'1t$8 (3 0 2) ^^^fB-r-St. 
^r-yFfiMMSgP (10 5) l,tCtl^^T&U--C-^mm 
gpi F (10 6) JferA-bTTttW-^^aaiS (5 4) ic 
teJM-rSc I P^^^-y F:*#S:tf^©ta:tr*7'-fe;l''\>y 

(3 0 2) t^smt^t. -f&u-c^mm^ 

(5 4) ^<Dm*r*y-b;l^>y^^''(f?gte»t5^j!jy 

-fe;b'^-y:je^:&i^U ^©;^:/-fe;l/-^'y ^Icj; I P/-^ 

/t/^^^r-y F^3r;I/-3J (1 7) tcM«-rs„ 
[00 5 1]J&(±. 04 3t)>S08^fflV^TVPNX'y>' 

g^ffit/^SC: tlC<fc>3. Pi— (DtlSl'>':5?:7i— xt. 
S^ftSVPNlCM'TS^'^y-y F*^3@Hl^n5®-a--eaBo 
Tfe. ^txSTbm-rs VPN^r^giJ-rSJlfcTb^pItgi:*: 
So Sfc. m— (DX-yS;';!/— :J?*\ S^SIP©Ttty 



(10) 



#g|2 0 0 1 -3 4 5 86 4 
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n^erKOTii-ym h n;Vtc^tjSL/ciim V P NW^grj^ 

■e. VPN^oe*jS:^)^fi^o 

[00 5 2] V P Nffl7]/—7^^ V^^T^- 

CO 0 5 3] ifmmm^^'^x.t^'r—y'M^mmm^^-- 

a^t^§^^r;l/dryXi^^ffl^/^TfeJ;^/>L. CAM 

(Content Addressable Monory) ^ffi'Q>^^^'^^ 7^ — 
[0054] VPNx^y ^S«:6'«^^}'iiJ^«[Hl*i 20 

VPNlSgrj?^:Lr. VPNW|gU?S^-7^-:/;Hc:$?-i^ 

[0 0 5 5] VPNx^yS^;!/— tl?SM7bV— -y-^^y 
IRSL. -r— -y-^^v^y h±(7)/^^^y b;6nEEE802. IQ^Cf^fo 
TVLAN;^>^-tr;W(:^nTV^;5«^. TfuWi'^Qiil 30 

SaMT^»i0^L/c#1f|gOftS. VLAN T a gHlg^^SlI 
^T^xfcl/^o VPNlKgrj^^UT. VPNIi 

m^m&T-'zrMz. V L a N Tag 'ff^:Sr^ LT 
cfci/\ ^fc. VPNigSSU7"-y^;l/(r)«S^-^LT. V 
LAN T a gWlg^&Ml/^rt <J;V^o 
[0 0 5 6] I P/^>^^y h^'^L 2 T P (Layer 2 Tunnel i 
ng Protocol) T^S^^nTV^^ L 2 T Y^y^^'^i:^^ 

^^Hb^nri/^^W^. vPNissu^^LT. vpnis 

SU-^^S-r- >^Vl/JCL2TP;«7 ^y ^^^I^O#1f ^ ( h 4o 

[0 0 5 7] ^fc. IP/^^^y h:6WP Over Ethernet:^ 

#BC>ftB. PPP Over Ethernet:^ y-fe;V{fc;77STMS^n 
Tl/^§:^y-lr;l/M$g^AOx.T^<fc^/\ C^D^-^. VPN 
IKSU^^bT. VPN»SU^^^^-:/;WCPPP Over E 
thernet:^ ^'^M\l-ff&'^^'^'^^X\.-^^ij y^^f^Wk 
(•ir^yS/3 VID^) ^K^LT'^cfcl^o so 
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[0 0 5 8] 09t±. *^0JfDVPNX^yi;^;l/— 

(9) (r>mommPt7^^o ^zyi^-y:^-^:^-^ 
(4 0 0. 40 1) ti:, ^n^tl. OTfuW*^0 

iiW^?— :7j:— X;^-F (4 0 0) ti:ATMfflcD-r:y 
:^-7j:-X:^-FT^S^5. ATMlBJlg (4 0 2) ^IR 
^fSo Sfc. -Y:y^-:7a:-X;^-F (40 1) ItP 

osfflcD^v^f-:7x-x:^-F't?35D. posmn 

(4 0 3) ^iimT^o 4>^-y:iL-X:^-}^' (4 0 

0. 4 0 1) itmm'^mr:$>^. jv-^iD^^mmit. 

^:&Tfi W^:/a F n;Vffl<7)>f ^^t^?— :7x— X:^— F 
i-X;^;-Ftcti:. ^Tffil^-Tirya F n;Hc##cr)^ 

ii^?T'5Tffiw^®agp (4 0 5. 4 0 6) trnm-^ 

tlTl^^So TffiWi'MSgP (4 0 5. 4 0 6) (OmV^ 
04<DTffiW^ffiag|5 (5 3. 5 4) tmMX^ 
§0 /^^*y F^Qf^;^— F (4 0 7) ti:Mf3'Y V^?— :7 
-7.tf-\^tf^i^ I P/^^r^y F iP*Dlf ?g;&^tjffi( >''^^ 

-F (4 0 7) ti^KRiti^^feD. )V-^(Dmmmt^±. 

^—V (4 0 7) ^4. 0 5^^l^TSiB^Lfc/^ 

^^y Fi^^^^asgp (5 2) ff^mm-^tirx,'^^, mmm 
i\mT^-fi^^ya:.-x:^'-V(Dmm. lan^^ 

T. M®^* (5 7) fy^^^ ^^^yhmm:^-]^ (4 0 

7) rtfovpNiisu^s^'r-:/;!/. vFNmm'r-zr 

;VlcS^^§2:i:;^)^T^^o :*:*SSMC>VPNX^yi;^;l/ 

[0 0 5 9] mi Of^^^mi 2ti. m9(D/i^y FMa 
:^7— F (4 0 7) ^clR^^n^^V^y^^-X;d-F 
^. /^^^y FMM:^-Fti:iSSf^n§VPNiSgrj^^^ 
7"-:/;K vPNiSgrj7"-:;^;K vpnM;v— t^^v^ 
7"-y^;l/^og8^>gr^t-E"r^*^o ^1 O;0^5>El 2 
fri:. J^yiyjV-^lciUWtsn^L AN ai-/i/Vl/-^ 

(9) <0«^M*C>^^^V^->^j:-X:^-F^>''?^r 
^y FO^^^To ^fc. /^^^y F®.M:?57— F 

rto V P N^gO^K^-r- >^;K V P Nm^iy^-y^K 
V p N fla;i/-T^ ^ t> tOT^fe ;5 o 

mi ot^^mi 2xi±. m — r^^^-yx— x:^?— ff*? 

mm-^n^m^^^i^ri.-^^o ccorcisb. vpNi^grj? 

^^m^^^ii^-Stfi^\^^(DX\ mi 0:6^^^ 1 ZXl±. 

t(omm^—t LTiOi^a'Y>^?->^x-xs^ti#s& 

^tiXl^^o lRlWV^f-:7x-X:^-FP*in?. S35:§ 

VPNiigrj^^^^^ffi^^tl^:^^. ±5EC><i;'9tcVPN 

ligU?^^7^-::7VboM^^-^ l.xmm^:y^-yx. 
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(11) 
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20 



[0 0 6 0] 01 Ol±^ /-^^^y h^a:d-F (4 0 7) 
tcATMffl^V^-yx-X;^-F (4 0 0) timm-^ 

?^S'r-::/;K V P N!iSrj'r-:7VK VPNffl;V— 7" 
^ V^^^-r— «^M^^^o L A N 1 (4 5 0) 
tiVPNAtcML. LAN2 (4 5 1 ) V P N B tcM 
bTV^^^^-rSo LANl. L AN 2 ib^^(D/^^^y hit 

^Mitmm (4 5 2) T^fi^n. (4 5 3) 

bTATMS-f V^-7j:-X;?7-F (4 0 0) ^ciK^ 10 
^n§o ^«^n^^^ LANK LAN23b^&0/^^ 
^yh^ctiVPK VC I ^LT-^n-=e^na. b^V^dfit 
:^)^^fiJD^T?>nTl/^^^^;&o **SS0tmi:. VPNM 

(4 0 7) V PNiiBU^^^7^-y^;l/ (4 5 5) Ic 
tiVPN^gfJ^^LTVP K VCI:6^K^^n^o V 
FNmWi'r-y'jV (4 5 6) icti^^4^-^bTVP 
K V C I >J>'!^^^nSo V P Nffl;V-7"^ -y^y-—^ 
;l/^LTtiVPN AM;V-7"^>^^-r->^;l/ (4 5 

7) . VPNBffl;l/-x^^/^>-::/Vl/ (4 58) IfWi 20 

^te»nso M^j^. LANi ;b^e»/^^r^y h^§M*r§ 

ATMffl'YV^?->^a:-X;^-F (4 0 0) P^OT 
ffil^^ -VMSgP (40 5) ti:. A T M^m h 
U I P/^^^y h*^SrfVP K VCKM-f>'^ 
— :7^-X#^^^/^^^y hmS^-F (4 0 7) 
m^^o ^^^vV^W^-Y (4 0 7) f^^DVPN^ga 

(4 5 5) i&«I^U VPNSJgy^tLTV 

P K VC I^ffll/^^cl^^^g^^^^o ^{t/"^>>- 
^yhfOVPK VCIfDfe. " a". ^^fflV^TVPN^ 30 
mr—'^lX^ (4 5 6) ^^^U ^M/'^^^y h;O^VPN 
AtcB-r^^i^^&^'J^r^o :^lcVPNAffl<r);i/-7^^ 
(4 5 7) ^^^b. ^-h-^^. *3cfctfffl 

[0 0 6 1] 01 Hi. /^^*y F^aS5!j-F (4 0 7) 
tcPO Sffl-f V^-:7x— X:^— F (4 0 1) 
n^»#Jcfett^. /^-ir^y hi[La:^7-FP^^D VP NiggU 

?K:S7"-r^;b; v p NS8gU'r->^7K vpnm;v-7^ 

[006 2] LANl (4 5 0) tiVPNAtcSb. L 40 
AN2 (4 5 1) t±VPNBJC||LTV->^^t*So LA 

NK L AN2tJ:^n'?^ninIII (5 0 0) . (5 0 1) 
^iW^XVO^Wi-^y^—y :sL-ysti-Y (40 1) 

iKS^n^o iHisa (5 0 0) sttfiuii (501) ^ p o 
sm^^y^—y^—:^ti—Y (4 0 1) 

-y^^-xif^^^ti^^nK 2^-r^o co^-^. V 

PNaigUtcti:%fll^^^:^-:7i-X^&fflV^§fci6. 
^yF^S:^-F (4 0 7) F«g(DVPNl8ga?IS^7^->^ 
(4 5 5) ^ct±VPNiigU?^LT%a'i'>'^?-yx 
-X»^:6^K«^tl^o V P NiSgfJ-r- >^;b (4 5 6) so 



VPNffl7l/-7^^>^>— >^;l/^LT. VPN AM 
v^J^^t"— (4 5 7) . VPNBffl;!/--/^^ 
l/^^r—^l^y (4 5 8) ;^)'!^&te>n§o >''^'y^y 
-F (4 0 7) 01 0>^fflV^TiiB^bfc«[l 

S^^^^^S^o fcfcU VPNiiSrj-?^LTVP K 

[0 0 6 3] 01 2ti. 09^C0^LTl^^V^;6\ /^^r 
^yFMa;^-F (4 0 7) tc^^^9J^«lU^fflcD-r 
-:7j:-X:^-F (5 5 0) if^^m^^^^Xz.^l'^ 
/^y^y h5ail:>^-Fp^^0VPNiiSfJ^^ST'->^ 
;K VPNiigU-r-r/^K V PNffl;!^-^^^ v^^t^-:;/^ 
«^M>^S^^o LANl (4 5 0). LAN 2 

(451). LANS (5 51) LAN4 (55 2) \± 
^n^^nVPNA. VPNB. VPNC. VPNDtcM 
LTt/^§^:t-§o LANK L AN2c0T{4ynFn;l/ 
l±:7L--i^y W LANS. LAN40Tfi[:/n 

hr3;l/tiPPP (Point to Point Protocol) ^^T^o 

LANl i:LAN2;6^6fO/^'5r^y FtctiDLC I ^ LT 

^n-rnio. 2 o:6^iijt)ST?>n. ^n^o/^^^yh 

ti:. :7Wi^UU-^M{[:Sg (5 5 3) JC$5V^T. HI 
*a (5 5 4) tei^fift^tl^o B#^>*J^Sfb« 
B (5 5 5) tC4i5l/^T. HlSg (5 5 4). (5 5 6). 

(5 5 7) Tb^msa (5 5 8) tc^a^n^c <:o^. m 

^(5 5 4). (5 5 6). (5 5 7) (r>'T—^\Z,\t^ 
n^^n. ^?^AXn^yF#^K 2. Sib'^fiJ?) STStl 
Stt-^o LANl. LAN2lc:^tr;svPNiSgU?^ 
brtJ;D L C I ^'^ffll.'^^n. LAN3s L A N 4 JcM^T 
^VPNffl^g^J?^LTti::$^■Yi^Xa^y F#^7bm^e>tl 
S^-r^o CltO^a-. VPNiSgfM^T^-:/;!/ (4 5 
5) Tffil--r-^7'nFn;l/ (5 5 9) :6^^:7U 

—h.^)\y—X^:^:si.i/Y^)\z.m.X\±. VPNiiga?^ 
bTDLCI (5 6 0) Tb^fi^^tl^o ^fc. TfiU-f 
•^'^O^P P PT^feSXVF y ic^LTtiVPNISga^ ^ b 
T^Yi^Xn^y h#-9 (5 6 1) ;b^'S^^tl^o VPN 

»^gfj7"-~:/;l'i:LT. 2'::)0'r-:/;K 'r:^^-^. DL 
c I i:VPN#^(0?5fjS^^'rvPN^gU7^-:/7i/ (5 

6 2) :57-^i^Xn^y hS-^^ VPNS^OJtJS^^ 

'rvPNiiga-x-::/vv (ses) ^;6Wt^n^o ^ 

VPNflB;l/— T^-O^^^-r-y^l/^LT. VPN AM 
7-^>^^7"-:/;V (4 5 7) . VPNBM;l/— 

(4 5 8) . VPNCM;V-«^^ V^V- 

(5 6 4) StfvPNDM;!/— r^^/^x-:/;!^ 
(5 6 5) :«?^^tte»n^o /^y*y h«La5?7-F (4 0 

7) \hi<r>%m\t^ 01 o^Mi.^T»i0jbfcMiitiwi;^-e 
fe^o /c/cL. vPNia5g[|?^'7^-::/;v«l^^tc. « 
^4^--i:LTTffiW-V:/aFn;l/ (5 5 9) 

m^m^^. sfcvPNiiga^»^7^->^vi/«^mo^ 

VPN«gfi?^bT. LANK LAN23b^?,g^l 



(12) 
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Lfc/'^^^y htcHLTtiD L C I ;6^ffiM^ti. LAN 
10 0 6 41 m9tpi^m I 2Tl,±. iOfO/^^^yh^H 

[0 0 6 5] mi 3ti. ^'^^r^;; hMS:???— F (4 0 7) io 

nmWl^m&'r-y'jV. VPNiigrJ-r->^;K VPNffl 
-X:^-K (4 00). (4 0 1) ti^n^nATM 

Ms posmtT^o mi 3t±. Ill— rv^— :7x— X 

^6. X:^7— F (4 0 0) . (4 0 1) 20 

{cti^n^n:^- F#^ K 2:&WD^Te»nSTV^ 

§0 (455) ^d^^ 

^— i:bT. :^-F#^ (6 0 2) ?5)^^^^n^o LA 
Nl (4 5 0). LAN2 (451). LANS (5 5 
1) LAN4 (5 5 2) ti^tl^nVPNA. VPN 
B. VPNC. VFNDlcmi^ri^^t^^o LAN 

K LANztf'^o^/^^yhit^mitmm (452) 

^*^n. (4 5 3) */rLTATMM-YV^-:7 

:ii-x;?7-F (4 0 0) tciKs^n^o ^m^n^m. 

LANK LANZti'^(D^i^yhlC{±VP I. VCI 30 
f^o clfO:^. VPN^ga^CtiVP K VCI^MV^ 

nt^^<fci/\ V p Niisa^^^T"- (455) tc^s^t 

^. F#^10X^hy (6 0 3) ^C^fLTti. V 
PNi5Srj?i:bTVP K VClTb^^^tiSo LAN 
3. L AN4ti^n?^tl[iI)^ (5 0 0) . (50 1) ^fe 
/^LTPO SM-t'V^?— yj:-X:^-F (4 0 1) tClR 
S^nSo HISS (5 0 0) . (5 0 1) ^POSffi-Y> 
:7j:-X::^— F (4 0 1) t(D^m'^ — y — 

Ts^^^^n^^m. zt^^c c(om^. wpNmm 40 

(4 5 5) icmf^. :^-FS^20x. 
>hU (6 0 4) ^C^tLTti:. V P Nligrj^^ bTt?S 
-rv^-7a:-X;&^^S^n§o VPNiig(j7^->^;l/t 
LTti. V P K V C I ^ V P N#^©>t^jS*^*r*r~- 
(6 0 0) W^>'^-yji-X#-^^ VPN 

#^o^jS^s^T-r— (6 0 1) ^;^wte>n§o 
V P NM;i/-7"-< v^^^T"-:/;!/^ LTti v p N Affl;i/— 

7"^>'^x~:/;v (457) . vPNBffl;i/-7"^>^'^^ 

"r—y^jV (4 5 8) . V P N C mJ^y-v-^ V^^t^-:/;!/ so 
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(5 6 4) . VPNDffl;^-^"^^^^^-:/;!/ (5 6 

5) tffmif^ti^o ^^^-^hmm:^-¥ (407) 
commit, mi o^m^^rmmi.rcmMtmmij$>^o 

fcfcL. VPNaSS0^^^7"->^;V«fgmi:. 
^LT;?7— F#-^ (6 0 2) ^Mv^^j;S;^)^fi*^o c C 

(Dm^^t^'^icm^n^i>(D^'it^i^''o m^it. pos 

ffl>r>^f>^x-X;«7-F:^F Rffl-rv^:7ji-X?57-F 
\cm^^<^t^mmT^^o ^O^. LAN3S:tfL 
AN4:^^60/"^^^y Fti. L AN 1 L AN 2 
ic^ — *<r)|lISSJc^SLrFRM-<V^?7x-X:^-F 
tcA:^j^n^J;'9^i:. D L C I 't?VPN;&i6grj'r§ j;^ 

CO 0 6 6] &L±. H9^^^H1 3*fflV>T»iB^L/ccfc 

(5 7) >^'^^^y hMll:^-F (4 0 7) f^OVP 
Nil03a?S«-r-:r;K VPNlSSfj7^-:/;V. VPNM 

<i^jb^7?^^o sfc. ^a-Y^^^-^x-xtc^m^n 

fc^SW^Sz^-VJ^^l/S^Jc J: t) V P N^lffifJ-r^tOT*. 

-c>coiHj^tc^iffi9ii:^a^n;rc V p NJ&iSSU'rs c t 

[0 0 6 7] HI 4 tC. ^V^^yai-Xr^-F^^^T 
^^C). /"^>>-^y F«m:!?7-F (4 0 7) (OS^^jKHtD- 

M^^-To VPNa:^y>s^;V-^ (9) tC-Y V:$?:7:i:-X 

:^-}^ffmm^nrcm. ^^^^-^hmmti-v (407) 

rtcDVPNlSSQ^S^^-:/;!/ (4 5 5) ^^S^^tl^ 

(7 0 K 7 0 2) o VPNiiSrj^^^'r-::/;VfO^^ 
ti. ^^'r^-fv^?y^x-X;^7-FO@SUti:<3;t). 

PNMegrffStc. V P NiKgy-^-:/;WS^^n^ (7 
0 3) o VPN»c;l/— v^r--:/;l/:&'s»^^ns 

(7 0 4) o 

[0 0 6 8] VPNMSSa^O^ti. ^V^f->^x.-X 

:7j:-X:^-F^>'1>5r^y hJ[ill;^-F^Ta«^tTi/\ 
-rvt5?->^x-X:j!7-F7b^^«1-^ I P/^^y FOTffi 
l/-i'^coynFn;l';&gltl6^tcW^LT/^^^y F5[iS;^ 
-Ftcii»l'r^<J;'5lcUT^<];i^o ^oS^^nf^Tffi 
U-^-^oya F n;l/JcJ^jSLTM^^n/ciSgfJ'[^;&. 
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